Discuz7.2 faq.php页面注入漏洞分析

　　由于discuz在全局会对GET数组进行addslashes转义，导致该漏洞的产生。

参数问题存在于faq.php的grouppermission函数中。

 

具体细节访问：网易博客siberia

http://easyboy1.blog.163.com/blog/static/2641120382017101025749306/

http://easyboy1.blog.163.com/blog/static/2641120382017101025749306/

http://easyboy1.blog.163.com/blog/static/2641120382017101025749306/

转载于:https://www.cnblogs.com/XiaoH160309/p/7874245.html