Sofi WebGUI 'modstart.php'远程文件包含漏洞

BUGTRAQ ID: 31341 CNCAN ID：CNCAN-2008092407 Sofi WebGUI是一款基于PHP的WEB应用程序。 Sofi WebGUI不正确处理用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意PHP代码。 问题由于'modstart.php'脚本对用户提交给'moddir'参数缺少过滤，指定远程服务器上的任意文件作为包含对象，可导致WEB权限执行任意PHP代码。 Muskatli.Net Sofi WebGUI 0.6 pre-release-3 目前没有解决方案提供：...

Sofi WebGui <= 0.6.3 PRE (mod_dir) Remote File Inclusion Vulnerability

No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl Sofi WebGui = 0.6.3 PRE Remote File Inclusion Vulnerability Script site:...

sofiwebgui-rfi.txt

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl Sofi WebGui = 0.6.3 PRE Remote File Inclusion Vulnerability Script site: http://www.muskatli.net/studio/hu/?f=sofi-wgui-hu Download...

Sofi WebGui 0.6.3 PRE - mod_dir Remote File Inclusion

Sofi WebGui 0.6.3 PRE - moddir Remote File Inclusion :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl Sofi WebGui = 0.6.3 PRE Remote File Inclusion Vulnerability Script site:...

Sofi WebGui <= 0.6.3 PRE (mod_dir) Remote File Inclusion Vulnerability

Exploit for unknown platform in category web applications ====================================================================== Sofi WebGui = 0.6.3 PRE moddir Remote File Inclusion Vulnerability ====================================================================== :::::::-. ... ::::::. :::. ;;,...

Sofi WebGui 0.6.3 PRE - 'mod_dir' Remote File Inclusion

:::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ "Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP" "YmmMMMM"" MMM YM Discovered by dun \ dunatstrcpy.pl Sofi WebGui = 0.6.3 PRE Remote File Inclusion Vulnerability Script site: http://www.muskatli.net/studio/hu/?f=sofi-wgui-hu Download...

Information disclosure

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

CVE-2008-3503

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

CVE-2008-3503

RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System CS RSS feeds, which allows remote attackers to obtain sensitive information CS data...

CVE-2008-3503

Plain Black WebGUI prior to 7.5.13 has an RSSFromParent flaw that does not restrict CS RSS feed view access, enabling remote disclosure of Collaboration System data. A fix is available in 7.5.13 (beta released) and later versions; upgrade to mitigate. Technical details: affected product/component...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web GUI in SAP Web Application Server WAS 7.0, Web Dynpro for ABAP aka WD4A or WDA, and Web Dynpro for BSP allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI under bc/gui/sap/its/webgui/...

SAP Web Application Server crossite scripting

Crossite scripting with /sap/bc/gui/sap/its/webgui/...

CVE-2008-2077

Unspecified vulnerability in Plain Black WebGUI 7.4.34 has unknown impact and attack vectors related to "data form list view."...

Design/Logic Flaw

Unspecified vulnerability in Plain Black WebGUI 7.4.34 has unknown impact and attack vectors related to "data form list view."...

CVE-2008-2077

The CVE-2008-2077 entry concerns Plain Black WebGUI prior to version 7.4.35, where data form list view handling is implicated. Connected sources indicate a vulnerability labeled as WebGUI

CVE-2008-2077

Unspecified vulnerability in Plain Black WebGUI 7.4.34 has unknown impact and attack vectors related to "data form list view."...

WebGUI < 7.4.35 Data Form List View Unspecified Vulnerability

Binary data 4489.prm...

Cross site scripting

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407...

CVE-2008-0940

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407...

CVE-2008-0940

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407...