Shadows Rising RPG远程文件包含漏洞

Shadows Rising RPG是一款基于PHP的论坛程序。 Shadows Rising RPG不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于多个脚本对用户提交的'CONFIGgameroot'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 Shadows Rising RPG Shadows Rising RPG 0.0.5b Pre Alpha http://sourceforge.net/projects/shadowsrising/...

CVE-2006-4329: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in Shadows Rising RPG Pre-Alpha 0.0.5b and earlier allow remote attackers to execute arbitrary PHP code via a URL in the CONFIGgameroot parameter to 1 core/includes/security.inc.php, 2 core/includes/smarty.inc.php, 3 qcms/includes/smarty.inc.php ...

CVE-2005-2951

Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" trailing null byte characters in the l parameter, which is used in an includeonce statement...

CVE-2005-2951: Undefined Security Weakness

Directory traversal vulnerability in security.inc.php in AzDGDatingLite 2.1.3, and possibly earlier versions, allows remote attackers to execute arbitrary PHP commands via ".." sequences and "%00" trailing null byte characters in the l parameter, which is used in an includeonce statement...