7 matches found
CVE-2018-8756: Improper Control of Generation of Code
Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...
PT-2018-18616
Name of the Vulnerable Software and Affected Versions YzmCMS version 3.7.1 Description The issue concerns an eval injection in a specific PHP file, allowing remote attackers to execute arbitrary code. This is achieved by sending PHP code in the POST data of a particular request to...
MetInfo v5.3.1 global.func.php SQL注入
No description provided by source...
Discuz 7.x /include/global.func.php 跨站脚本漏洞
No description provided by source...
Destoon最新全版本通杀SQL注入漏洞
简要描述： Destoon最新全版本通杀注入漏洞 详细说明： /common.inc.php 64行： ------------------------------------------------------------------------------------- if$POST $POST = stripsql$POST; //stripsql过滤 if$GET $GET = stripsql$GET; if$COOKIE $COOKIE = stripsql$COOKIE; ......... if$POST extract$POST, EXTRSKIP; //注册变量...
PHPCMS 9 /phpsso_server/phpcms/libs/functions/global.func.php 信息泄漏漏洞
PHPCMS是国内一款非常流行的网站内容管理系统，其V9版本中存在信息泄漏漏洞。漏洞根源位于\phpssoserver\phpcms\libs\functions\global.func.php文件，sysanth函数在使用substr时没有判断其参数是否是字符串，从而当外界传入数组时导致服务端抛出异常，攻击者可以通过该漏洞获取服务器文件的绝对路径等信息。 PHPCMS 9...
Discuz forum to blast the physical path principle-vulnerability warning-the black bar safety net
Affected version Discuz! 5.2 Discuz! 5.1 Discuz! 4.1 Discuz! 4.0 ............. 1. common. inc. php issues code 2 0, line 7 ..... $navtitle = $navigation = "; $extra = isset$extra && pregmatch"/^+$/i", $extra ? $extra : "; $tpp = intvalempty$DSESSION ? $topicperpage : $DSESSION; $ppp =...