Bo-Blog 2.0.3 whizzylink.php 文件信息泄露漏洞

No description provided by source...

CVE-2007-1773: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a .. dot dot in the d parameter to 1 whizzery/whizzypic.php or 2 whizzery/whizzylink.php, different vectors than CVE-2006-6384...

CVE-2007-1774: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in aBitWhizzy allow remote attackers to inject arbitrary web script or HTML via the d parameter to 1 whizzery/whizzypic.php or 2 whizzery/whizzylink.php...

bo-blog2.0.3文件浏览漏洞

O-blog2.0.3的编辑器存在一个文件浏览漏洞,存在漏洞文件在于whizzylink.php和whizzypic.php,不过前一个可以浏览任意文件和目录,后一个只能浏览目录和图片,并能查看图片br / br / $docpath = $REQUEST'd';br / $extensions = $REQUEST'x' ? '/' . $REQUEST'x' .'$/i' : '/.html|pdf|txt$/i';br / $d = $SERVER'DOCUMENTROOT' . '/' . $docpath;br / $d = strreplace'//','/',$d;br /...