PT-2018-14876

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows XSS via the first input field to the "admin/type.php?id=1" URI. Recommendations For LAOBANCMS version 2.0, consider disabling access to the "admin/type.php?id=1" URI until a...

CVE-2018-19226: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in LAOBANCMS 2.0. It allows remote attackers to list .txt files via a direct request for the /data/0/admin.txt URI...

CVE-2018-19224: Reliance on Cookies without Validation and Integrity Checking

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

CVE-2018-19221: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

PT-2018-14882

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows XSS via the "admin/art.php?typeid=1" endpoint, specifically through the biaoti parameter. Recommendations For LAOBANCMS version 2.0, as a temporary workaround, consider...

CVE-2018-19222: Improper Neutralization of Input During Web Page Generation

An issue was discovered in LAOBANCMS 2.0. It allows a /install/mysqlhy.php?riqi=0&i=0 attack to reset the admin password, even if install.txt exists...

PT-2018-14877

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows spoofing of the id and guanliyuan cookies in the /admin/login.php API endpoint. Recommendations For LAOBANCMS version 2.0, as a temporary workaround, consider restricting...