Description
Discuz! 4.0 rc4不能正确地限制上传至服务器的文件的类型。这使得远程攻击者可以借助于包含".php.rar"的文件名或其它多个包括".php"的扩展名执行任意命令。
Discuz! 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://blog.nsfocus.net/discuz-arbitrary-file-remove-vulnerability/
https://www.anquanke.com/post/id/86967
https://chybeta.github.io/2017/10/15/DiscuzX-v3-4-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E6%BC%8F%E6%B4%9E/
https://www.cnblogs.com/zhaijiahui/p/7653223.html
https://cloud.tencent.cn/developer/article/1079473
https://oopsdc.com/post/discuzx3.4%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/
https://lorexxar.cn/2017/09/30/dz-delete/
https://www.tenable.com/plugins/nessus/19751
https://pentest-tools.com/vulnerabilities-exploits/discuz-400-rc4-arbitrary-file-upload-flaw_13840
https://github.com/bakery312/Vulhub-Reproduce/blob/main/Discuz!X%20%E2%89%A43.4%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E6%BC%8F%E6%B4%9E.md