CVE-2021-39433

CVE-2021-39433 로컬 파일 포함LFI 취약점이 BIQS IT Biqs-drive v1.83 이하 버전에 존재하며, download/index.php의 file 매개변수로 특정 페이로드를 전송할 때 발생합니다. 이를 통해 공격자는 구성된 웹 사용자의 권한으로 서버에서 임의의 파일을 읽을 수 있습니다. curl https://TARGET/download/index.php?file=../../../../../../../../../etc/passwd...

CVE-2021-39433

A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user...

Reflected Cross-Site Scripting Vulnerability in MetInfo Version 5.3.3

MetInfo is an enterprise website management system with PHP Mysql architecture. A reflective cross-site scripting vulnerability exists in MetInfo version 5.3.3. An attacker can exploit the vulnerability to conduct cross-site scripting attacks. The vulnerability exists in the following pages:...