Discuz! milu-seotool Plugin Local File Inclusion Scanner

Discuz! is a widely used community forum software system, known for its flexibility and ease of use. It is popular among online communities and forums, allowing users to create, manage, and participate in discussions. The software supports a variety of plugins to enhance its functionality, including the milu_seotool plugin. This plugin is designed to assist with search engine optimization (SEO) tasks within the Discuz! platform. It is commonly used by webmasters and forum administrators to improve the visibility and search ranking of their forums. However, the software and its plugins must be maintained regularly to ensure security and optimal performance.

The Local File Inclusion (LFI) vulnerability in the Discuz! milu_seotool plugin can allow attackers to include local files on the server. This type of vulnerability often arises when file paths are not properly validated or sanitized. An attacker can exploit LFI by manipulating input parameters to include unauthorized files. This can lead to the exposure of sensitive information or execution of unintended code on the server. The risk is significant, as LFI can sometimes be escalated to Remote Code Execution (RCE) if certain conditions are met.

The vulnerability specifically affects the 'file' parameter within the milu_seotool plugin's functionality. When the plugin processes requests, it fails to properly sanitize user-supplied input for the 'file' parameter, allowing directory traversal sequences like '../' to be injected. This enables an attacker to read arbitrary files from the server's filesystem, such as configuration files containing database credentials or other sensitive data. The endpoint is typically accessed via a URL like /plugin.php?id=milu_seotool:file&file=../../etc/passwd.

If exploited, an attacker can gain unauthorized access to sensitive server files, including configuration files, source code, and user data. This could lead to further compromise of the Discuz! forum and underlying server, potentially resulting in data breaches, defacement, or complete takeover. The CVSS score of 7.0 reflects the high impact and ease of exploitation, making it a critical issue for forum administrators to address promptly.