ECSHOP商城系统过滤不严导致SQL注入漏洞

漏洞分析 首先来看includes/init.php文件，在getmagicquotesgpc为off时则调用addslashesdeep // includes/init.php if !getmagicquotesgpc if !emptyempty$GET $GET = addslashesdeep$GET; if !emptyempty$POST $POST = addslashesdeep$POST; $COOKIE = addslashesdeep$COOKIE; $REQUEST = addslashesdeep$REQUEST;...

Mandrake Security Advisory MDVSA-2009:071 (kernel)

The remote host is missing an update to kernel announced via advisory MDVSA-2009:071. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

CVE-2009-0675

The skfpioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFPCLRSTATS requests only when the CAPNETADMIN capability is absent, instead of when this capability is present, which allows local users to reset the driver statistics, related to an "inverted logic"...

Design/Logic Flaw

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...