CVE-2018-18925

CVE-2018-18925 利用 CVE-2018-18925 对 Git 自托管工具 Gogs 进行远程代码执行。 Gogs 基于 Macaron 框架。其用于管理会话的系统与 PHP 非常相似。Cookie 中的会话标识符映射到文件系统上的一个文件。当 Web 服务器收到带有会话标识符（作为 Cookie）的请求时，它会在文件系统上查找该文件。 该漏洞是在检索文件系统上用于会话的文件时存在简单的目录遍历。例如，您可以将 ilikegogits Cookie 设置为 ../../../../../../etc/passwd，从服务器获取错误信息。 利用方法：...

i18n 输入验证错误漏洞

i18n is a Macaron open source package . It provides internationalization and localization middleware for Macaron applications. An input validation error vulnerability exists in versions of i18n prior to 0.5.0, which stems from a problem with an unknown function in the file i18n.go that results in...

macaron: open redirect in the static handler

A flaw was found in macaron. Path URLs aren't cleaned before being redirected creating an open redirect in the static handler...

macaron input validation error vulnerability

macaron is a modular Web framework based on the Go language . An input validation error vulnerability exists in the static handler in versions prior to macaron 1.3.7. The vulnerability stems from a web system or product that does not properly validate input data. No detailed vulnerability details...

PT-2018-14725 · Go Gitea · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs version 0.11.66 Description: The issue allows remote code execution due to improper validation of session IDs. This can be exploited through a ".." session-file forgery in the file session provider, specifically in the file.go file. The...