Lucene search
RootSSV:61310HistoryJan 09, 2014 - 12:00 a.m.
Horizon QCMS "/download.php" SQL注入漏洞
2014-01-0900:00:00
Root
www.seebug.org
19
0.002 Low
EPSS
Percentile
56.3%
CVE ID:CVE-2013-7139
Horizon QCMS是支持PHP与MySQL的开放源码的Horizon快速内容管理系统。
该漏洞的存在是由于传递到"/download.php"脚本的"category" HTTP POST参数未被正确过滤，未经身份验证的远程攻击者可以在应用数据库中执行任意SQL命令。
0
Horizon QCMS<=4.0
厂商补丁：
Horizon
Horizon 4.0版本以修复此漏洞，建议用户下载使用：
The exploitation example below displays version of MySQL server:
http://[host]/download.php?category=%27%20union%20select%201,2,version(),4,5,6%20--%202
Related
prion
prion
Sql injection
2014-01-09 18:55:00
zdt
zdt
Horizon QCMS 4.0 - Multiple Vulnerabilities
2014-01-14 00:00:00
seebug
seebug
Horizon QCMS 4.0 'category' 参数SQL注入漏洞
2015-10-12 00:00:00
cve
cve
CVE-2013-7139
2014-01-09 18:55:00
cvelist
cvelist
CVE-2013-7139
2014-01-09 15:00:00
exploitpack
exploitpack
Horizon QCMS 4.0 - Multiple Vulnerabilities
2014-01-14 00:00:00
securityvulns
securityvulns
Multiple Vulnerabilities in Horizon QCMS
2014-01-09 00:00:00
packetstorm
packetstorm
Horizon QCMS 4.0 SQL Injection / Directory Traversal
2014-01-08 00:00:00
htbridge
htbridge
Multiple Vulnerabilities in Horizon QCMS
2013-12-18 00:00:00
openvas
openvas
Horizon QCMS Multiple Vulnerabilities
2014-01-17 00:00:00
exploitdb
exploitdb
Horizon QCMS 4.0 - Multiple Vulnerabilities
2014-01-14 00:00:00