Liquid-Silver CMS 'update/index.php'本地文件包含漏洞

BUGTRAQ ID: 27425 CNCAN ID:CNCAN-2008012403 Liquid-Silver CMS是一款基于PHP的WEB应用程序。 Liquid-Silver CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限查看系统文件内容。 问题是由于'update/index.php'脚本对用户提交的'update'参数处理缺少充分过滤，提交本地系统文件作为包含对象，可导致以WEB权限查看系统文件内容。 Liquid-Silver CMS Liquid-Silver CMS 0.3 目前没有详细解决方案提供：...

CVE-2008-0459: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in update/index.php in Liquid-Silver CMS 0.35, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. dot dot in the update parameter...

liquidsilver-lfi.txt

Liquid-Silver CMS Local File Inclusion Vulnerabilities http://sourceforge.net/project/showfiles.php?groupid=171166 author : Stack-Terrorist v40 foor read a php file ?update=name of file iwthout php for execute exploit does not write extention of file exploit : /Script/update/index.php?update=/nam...

Liquid-Silver CMS 0.1 (update) Local File Inclusion Vulnerability

Exploit for unknown platform in category web applications ================================================================= Liquid-Silver CMS 0.1 update Local File Inclusion Vulnerability ================================================================= Liquid-Silver CMS Local File Inclusion...

Liquid-Silver CMS 0.1 - 'update' Local File Inclusion

Liquid-Silver CMS Local File Inclusion Vulnerabilities http://sourceforge.net/project/showfiles.php?groupid=171166 author : Stack-Terrorist v40 foor read a php file ?update=name of file iwthout php for execute exploit does not write extention of file exploit : /Script/update/index.php?update=/nam...

Liquid-Silver CMS 0.1 - update Local File Inclusion

Liquid-Silver CMS 0.1 - update Local File Inclusion Liquid-Silver CMS Local File Inclusion Vulnerabilities http://sourceforge.net/project/showfiles.php?groupid=171166 author : Stack-Terrorist v40 foor read a php file ?update=name of file iwthout php for execute exploit does not write extention of...

phpunity.txt

phpunity.postcard phpunity-postcard.php Remote File Inclusion Exploit Affected Software .: phpunity.postcard Vendor ............: http://www.perlunity.de/ Class .............: Remote File Inclusion Risk ..............: high Remote File Execution Found by ..........: Rivertam Contact ...........:...

silvernews203.txt

Silvernews 2.0.3 possibly previous versions SQL Injection / Login Bypass / Remote commands execution / cross site scripting software: author site: http://www.silver-scripts.de/scripts.php?l=en&script=SilverNews SQL Injection / Login bypass: A user can bypass admin password check, if magicquotes i...

Silvernews 2.0.3 (possibly previous versions ) SQL Injection / Login Bypass / Remote commands execution / cross site scripting

Silvernews 2.0.3 possibly previous versions SQL Injection / Login Bypass / Remote commands execution / cross site scripting software: author site: http://www.silver-scripts.de/scripts.php?l=en&script=SilverNews SQL Injection / Login bypass: A user can bypass admin password check, if magicquotes i...