EUVD-2018-4975

Malware in sbrugna...

Code injection

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...

YXCMS 1.2.6任意文件删除可Reinstall

简要描述： YXCMS 1.2.6任意文件删除 Reinstall 详细说明： 前人经验： http://wooyun.org/bugs/wooyun-2010-047226 产生漏洞文件： protected\apps\admin\controller\photoController.php protected\apps\member\controller\photoController.php 关键代码： if!empty$photos'photolist' $phoarr=explode',',$photos'photolist'; foreach $phoarr as $vo...

yxcms sql注入漏洞

简要描述： yxcms注入漏洞 详细说明： protected/apps/members/conttoller/photocontroller.php 343行 else if'del'!=$POST'dotype' $this-error'操作类型错误',url'photo/index'; ifempty$POST'delid' $this-error'您没有选择',url'photo/index'; $delid=implode',',$POST'delid'; $photos=model'photo'-select'id in...