Jiangnan Online Judge 0.8.0 - Local File Inclusion

Jiangnan Online Judge aka jnoj 0.8.0 is susceptible to local file inclusion via web/polygon/problem/viewfile?id=1&name=../. id: CVE-2019-17538 info: name: Jiangnan Online Judge 0.8.0 - Local File Inclusion author: pussycat0x severity: high description: | Jiangnan Online Judge aka jnoj 0.8.0 is...

Directory traversal

Jiangnan Online Judge aka jnoj 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring...

CVE-2019-17537

The CVE-2019-17537 entry concerns Jiangnan Online Judge (jnoj) v0.8.0, which is affected by a Directory Traversal vulnerability in the web endpoint web/polygon/problem/deletefile?id=1&name=../ that enables arbitrary file deletion. Root cause stated across sources is improper/unsanitized path hand...

CVE-2019-17537

Jiangnan Online Judge aka jnoj 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring...

CVE-2019-17538

Jiangnan Online Judge (aka jnoj ) version 0.8.0 is vulnerable to a Directory Traversal (also classified as Local File Inclusion) flaw. The vulnerability exists because the system fails to properly filter special elements in the path of a resource or file, allowing an attacker to access locations ...

Design/Logic Flaw

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemtitle parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create...

PT-2019-15166

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue allows for arbitrary file upload. This can be achieved by uploading PHP code with a .php filename but setting the content type to image/png, and sending it to the...

PT-2019-15164

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue concerns a security problem where an attacker can execute malicious scripts on the website. This is achieved through the Problemtitle parameter in specific API endpoints, such ...

PT-2019-15167

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Problemdescription parameter. Th...