glFusion lib-session.php模块SQL注入漏洞

BUGTRAQ ID: 34361 CVECAN ID: CVE-2009-1282,CVE-2009-1283 glFusion是一个开源的内容管理系统。 glFusion的private/system/lib-session.php模块没有正确地过滤用户所提交的glfsession cookie参数，远程攻击者可以通过向服务器提交恶意请求执行SQL注入攻击。以下是/private/system/lib-session.php 的97-117行的有漏洞代码段： ... if isset $COOKIE$CONF'cookiesession' $sessid = COMapplyFilt...

CVE-2006-5262

The CVE-2006-5262 entry describes a CRLF injection in Hastymail 1.5 and earlier (before 20061008) affecting lib/session.php. Remote authenticated users can craft a mailbox name containing CRLF to send arbitrary IMAP commands; the attack may cross privilege boundaries if the IMAP server is configu...