EUVD-2007-0754

Malware in sbrugna...

DreamStats System Rootpath远程文件包含漏洞

DreamStats是一款基于PHP的WEB应用程序。 DreamStats不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。 问题是'index.PHP'脚本对用户提交的'rootpath'参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。 mnProjects Dreamstats 4.2 目前没有解决方案提供： http://www.mnprojects.com/dreamstats/ http://www.example.com/PaTh/index.php?rootpath=Shell...

Remote file inclusion

PHP remote file inclusion vulnerability in index.php in Miguel Nunes Call of Duty 2 CoD2 DreamStats System 4.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter...

CVE-2007-0757

CVE-2007-0757 is a PHP remote file inclusion vulnerability in the rootpath handling of the Call of Duty 2 DreamStats System (version 4.2 and earlier). The flaw in index.php allows an attacker to supply a URL in the rootpath parameter and cause arbitrary PHP code execution on the affected server. ...