CVE-2009-4623

CVE-2009-4623 Advanced Comment System 1.0 リバースシェル Advanced Comment System 1.0 における複数のPHPリモートファイルインクルードの脆弱性により、リモートの攻撃者が advancedcommentsystem/ ディレクトリ内の 1 index.php および 2 admin.php に対して ACSpath パラメータにURLを含めることで任意のPHPコードを実行できる可能性があります。注: この脆弱性は、管理者が install.php のインストール手順に従っていない場合にのみ発生する可能性があります。...

CVE-2020-35598: Improper Limitation of a Pathname to a Restricted Directory

ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...

CVE-2018-18845

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

CVE-2018-18845: Improper Neutralization of Input During Web Page Generation

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

CVE-2009-4623

CVE-2020-35598 (Advanced Comment System 1.0) is affected by Local File Inclusion via advanced_component_system/index.php?ACS_path=..%2f. Exploitation can lead to unauthorized file access and, per the Nuclei entry, may enable remote code execution and full system compromise. CVE-2009-4623 is relat...

CVE-2009-4623: Improper Control of Generation of Code

Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACSpath parameter to 1 index.php and 2 admin.php in advancedcommentsystem/. NOTE: this might only be a vulnerability when the administrator has n...