Discuz! X5.0 - Authentication Bypass

ExploitDBExploitDB exploitExploitEDB-52621

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2026-49952 in Discuz! X5.0 by sending a crafted login request to obtain an authcode via an encryption oracle, then using that authcode to access the dbbak.php database backup API without authentication.

Backdoor review

No backdoor observed in reviewed code

The PoC script performs only the documented authentication bypass exploit against Discuz! X5.0. It sends a crafted login request to obtain an authcode and then uses that authcode to access the dbbak.php backup API. No backdoor, persistence, credential exfiltration, or unrelated payload behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareDiscuz! X5.0
Attack typesauthentication bypassencryption oracle abuse
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs the steps to exploit the vulnerability: it crafts a malicious login request to obtain a valid token (authcode) and then uses that token to access a protected database backup endpoint. This constitutes exploit code, not merely detection or scanning.

exploits/multiple/webapps/52621.py:60-92

Requirements

  • Target running vulnerable Discuz! X5.0 (versions 20260320 through 20260501) with dbbak.php exposed.exploits/multiple/webapps/52621.py:11

Observed behavior

  • Sends a POST request to member.php login endpoint with a crafted username payload (default 'admin|1|0|0') to trigger the encryption oracle and extract an authcode from the response.exploits/multiple/webapps/52621.py:60-78
  • Uses the extracted authcode to send a GET request to /api/db/dbbak.php with operation=backup, bypassing authentication to access database backup functionality.exploits/multiple/webapps/52621.py:80-92
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
POST to /member.php?mod=logging&action=login&lssubmit=yes with username payload and password dummy123Exploit step to obtain authcode via encryption oracleexploits/multiple/webapps/52621.py:61-69
Network Request
GET to /api/db/dbbak.php with obtained authcode and operation=backupExploit step to access database backup functionalityexploits/multiple/webapps/52621.py:81-84
Review boundaries

What the analysis did not establish

  • Only the exploit script content is analyzed; external dependencies (requests, urllib3) and target behavior are not verified.
  • The script's effectiveness depends on the target's specific configuration and the presence of the vulnerable dbbak.php endpoint.
  • Only the supplied text file was reviewed; no binary or external resources were inspected.
  • The script's behavior depends on the target server's response; no server-side backdoor is claimed or observed in the client code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1