RoseOnlineCMS <= 3 B1 (admin) Local File Inclusion

漏洞出现在modules/admincp.php中 Click here to go back home'; obendflush; ? $admin直接通过GET方式获取 没有经过过滤 后面直接用include包含了 所以在PHP5.3的情况下 可以 通过%00截断 达到任意文件包含 payload http://0.0.0.0/modules/admincp.php?admin=LFI%00 '/ -.- --------------------oOO------OOo------------------- | RoseOnlineCMS = 3 B1 admin Local Fil...

CVE-2009-4581: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the admin parameter...