Xonic.ru News 1.0 – ‘script.php’ Remote Command Execution

Xonic.ru News 1.0 – ‘script.php’ Remote Command Execution

漏洞ID 1053799 漏洞类型
发布时间 2003-03-31 更新时间 2003-03-31
图片[1]-Xonic.ru News 1.0 – ‘script.php’ Remote Command Execution-安全小百科CVE编号 N/A
图片[2]-Xonic.ru News 1.0 – ‘script.php’ Remote Command Execution-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/22501
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/7365/info

A vulnerability has been reported for Xonic.ru News. The problem occurs due to insufficient sanitization of user-supplied data to the 'script.php' file. As a result, it may be possible for an attacker to pass malicious PHP or shell commands in requests to a target server. All commands would be executed on the system with the privileges of the vulnerable application.

http://www.example.org/admin/script.php?data=script.php?data=<? system($cmd) ?>

相关推荐: Doug Neal’s HTTPD Daemon (DNHTTPD)目录遍历漏洞

Doug Neal’s HTTPD Daemon (DNHTTPD)目录遍历漏洞 漏洞ID 1205598 漏洞类型 路径遍历 发布时间 2001-07-03 更新时间 2001-07-03 CVE编号 CVE-2001-1266 CNNVD-ID CNNVD…

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享