Arbitrary PHP Code Execution in Discuz!ML 3.2 through 3.4 via Modified Language Cookie

CVE-2019-13956 · HIGH Severity

AV:N/AC:L/AU:N/C:P/I:P/A:P

Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).

Learn more about our Cis Benchmark Audit For F5.