Discuz! X CVE-2026-105146

Exploitation requires an authenticated administrator session in Discuz! X5.0 (builds X5.0-20260801, X5.0-20260820, or X5.0-20260910) with access to the Admin Medal Moderation component, because the vulnerable modmedalsubmit function in upload/source/app/admin/child/medals/mod.php is an admin-only moderation endpoint (CVSS PR:H). The specific trigger is supplying a malicious value in the 'delete' argument of the medal moderation request. The primary limiting factor is the need for high-privilege admin access; no additional user interaction is required (UI:N) and the attack is deliverable over the network to the admin panel.

This is a moderate, not top-priority, issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:L/VI:L/VA:L) and its 5.1 score hinge on PR:H - exploitation requires an already-authenticated high-privileged administrator, since the affected code is the Admin Medal Moderation moderation handler (modmedalsubmit in upload/source/app/admin/child/medals/mod.php). That authentication barrier is the dominant risk-limiting factor: an attacker who already holds Discuz! admin rights has far more direct avenues of abuse than a blind SQL injection in a medal-delete parameter. Signals are mostly consistent: the input marks exploitation probability as Proof-of-Concept (E:P) and the description states the exploit has been made public, so public exploit code exists - but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active, widespread exploitation. The low VC/VI/VA (L) impact reflects that a single SQLi in an admin-only function yields limited, not total, compromise. Net: a real but low-urgency finding - a high-CVSS perception is not warranted; prioritize patching for internet-facing forums but below unauthenticated RCE-class issues.

An attacker who has obtained Discuz! X5.0 administrator credentials (or hijacked an admin session) submits a crafted value in the 'delete' argument of the medal moderation form, injecting SQL into the modmedalsubmit handler to read or alter database contents such as user tables. Public exploit code for this parameter already exists, lowering the effort required. Because the vector is PR:H, the scenario presupposes prior administrative access rather than anonymous remote compromise.