Unauthorized downloading of plug-ins with "read permission" and downloading of plug-ins without charge
Reproduction steps:
1. Use the Administrator account to upload an attachment with a high read permission. 2. Use a low-Permission user account to download the attachment. At this time, Discuz will prompt that the attachment has no permission to be downloaded, the attachment address in the browser is shown
Forum. php? Mod = attachment & aid = Nzg4fDQwNGQzYjMxfDEzODk2OTM4Mzh8MzEyNTR8MjY3Mw % 3D % 3D
Decoding aid 788 | 404d3b31 | 1389693838 | 31254 | 2673
Modify the uid section (change the uid to the administrator account here:
1) 788 | 404d3b31 | 1389693838 | 1 | aid forum. php? Mod = attachment & aid = Nzg4fDQwNGQzYjMxfDEzODk2OTM4Mzh8MXwyNjcz
At this point, the attachment that originally requires high permissions is successfully downloaded.
In addition, the download may also refresh the user's Last Logon Time (I also discovered this vulnerability by coincidence, because some cdns have all the base64 in the address in lower case, parsing error, resolved to another user's uid, and refreshed the last logon time by the way)
