CVE-2018-14729

This is a weakness in an older web forum package (Discuz!) where a built-in “database backup” feature can be abused. In the worst case, an attacker can trick your server into running their own code, which can lead to full compromise—like giving an intruder a master key to the server.

This matters if you use or host Discuz! version 2.5 or 3.4, because that’s exactly where the vulnerable database backup feature lives. It’s a remote risk, so it’s most dangerous when the relevant functionality can be reached from the public internet. If the affected admin backup function isn’t reachable from outside (or is tightly restricted), the risk is lower.

Treat this as urgent. Public proof-of-concept code exists, and the flaw is designed for remote exploitation without user interaction, meaning attackers can target exposed installations directly. Since exploitation confirmation via KEV isn’t listed, this is still an AMBER priority: fix quickly, but focus first on whether your Discuz! instance and backup functionality are reachable.

Confirm exposure

• Determine your exact Discuz! version in production. This vulnerability specifically targets Discuz! 2.5 and 3.4.
• Confirm whether the file/functionality involved (upload/source/admincp/admincp_db.php database backup feature) is present and enabled in your deployment.
• Check whether the admin area (admincp) and specifically the database backup endpoint are reachable from the public internet.

Patch / upgrade

• Apply the vendor remediation from Discuz! (discuz.com) as directed for CVE-2018-14729.
• Use your maintenance window to upgrade to the vendor-provided fixed Discuz! release. (The findings provided here did not include a specific fixed version number, so follow the vendor’s security update instructions.)

Temporary workaround (if patching is delayed)

• Restrict network access to admin/control pages associated with admincp so they are not reachable from the public internet (e.g., firewall/WAF allow-listing admin IPs, VPN-only admin access).
• Disable or remove access to the “database backup” function if your setup allows turning it off, or ensure it requires strict access controls.

After remediation

• Monitor logs for suspicious requests to admincp_db.php (and related admincp endpoints).
• Watch for signs of unauthorized PHP execution (e.g., unexpected new PHP files in web directories, unusual outbound connections, repeated 500/404 patterns tied to injection attempts).

KEV / timeline

• This CVE is not listed in the CISA KEV catalog (per the provided findings), so there is no KEV-driven “confirmed exploited” deadline here.

CVE-2018-14729 is a remote code execution vulnerability (CWE-20) affecting Discuz! 2.5 and 3.4. The mechanism is abuse of the database backup feature implemented in upload/source/admincp/admincp_db.php, where attackers can cause arbitrary PHP code execution from the network.

Exploitation status: public proof-of-concept (weaponization) is available (1 known public PoC). KEV does not list this CVE, so confirmed in-the-wild exploitation is not established by the provided findings.

Likelihood (prediction only): EPSS was reported as 7.9% with a falling trend, but this is not treated as proof of exploitation and should not be used as the sole reason to delay remediation.

Traffic-light verdict: AMBER, reflecting that the issue is serious (remote code execution) and there is weaponized code available, but without KEV confirmation in the findings.