DiscuzroomX foreground arbitrary file deletion vulnerability reappears

Vulnerability background:

DiscuzedX community software is a community forum platform with excellent performance, comprehensive functions, security and stability, which is built by PHP, MySQL and many other databases.

September 29th, 2017, Discuz! Fixed a security issue to enhance security that could lead to arbitrary file deletion vulnerabilities by foreground users.

The vulnerability was submitted to the Wooyun vulnerability platform in June 2014, and the vulnerability number ssvid-93588 was included in the Seebug vulnerability platform. The vulnerability causes arbitrary files to be deleted by configuring property values.

After analysis and confirmation, the original utilization method has been repaired, adding the formtype judgment of attributes, but the repair method can not completely lead to bypass, through simulated file upload can enter other unlink conditions to achieve arbitrary file deletion vulnerabilities.

Recurrence of vulnerabilities:

1. Enter the settings-profile, first find the formhash value in the page source code, and you can see that the value is 2599b5e5.

two。 Open a plug-in Hackbar

Post data: birthprovince=../importantfile.txt&profilesubmit=1&formhash=2599b5e5

After execution, a blank will be displayed. Just refresh it or revisit it.

3. The place of birth was modified to the file to be deleted.

Finally, construct the form to delete the file.

Generate .html, the above needs to be modified by yourself.

4. Then upload a random picture and you can delete what you want to delete.

5. Visit again and take a look back.

The reproduction is successful.