Discuz ML v3.x Front-End Getshell Technique

1. Vulnerability Description

Discuz! ML is a multilingual, integrated, full-featured open-source web platform created by CodersClub.org for building online communities such as social networks.

On July 11, 2019, a remote code execution vulnerability was discovered in Discuz! ML. An attacker can exploit it to execute code remotely by inserting a crafted payload into the language parameter of the request’s cookie field. The vulnerability is easy to exploit and poses a significant risk.

2. Cause

The vulnerability is caused by Discuz! ML improperly handling the cookie field.
The language parameter in the cookie field is not filtered and is directly concatenated and written into a cache file.
The cache file is subsequently loaded, resulting in code execution.

3. Affected Versions

Discuz! ML v.3.4
Discuz! ML v.3.3
Discuz! ML v.3.2

4. Exploitation Process

In short, the payload is passed through a cookie, and the crafted payload is written into a template file:

Note that this is the international version, not the version commonly used in China. Generally, the target needs to provide language selection; most affected sites are overseas forums.
It looks something like this:
在这里插入图片描述

The issue is located in:

Executable sample omitted in the English preview. Refer to the original Chinese article for the archived code.

Test PAYLOAD:

Executable sample omitted in the English preview. Refer to the original Chinese article for the archived code.

Modify XXX yourself.
在这里插入图片描述

Click GO and check the result.
在这里插入图片描述

4. Getshell POC

Executable sample omitted in the English preview. Refer to the original Chinese article for the archived code.

Original payload:

Executable sample omitted in the English preview. Refer to the original Chinese article for the archived code.

在这里插入图片描述

Visit the website to generate the webshell file godz.php; the password is godz.
Verify the webshell:

在这里插入图片描述