漏洞标题
N/A
漏洞描述信息
在WebYep 1.1.9版本中，存在多个PHP远程文件包含漏洞。当启用 register_globals 时，允许远程攻击者通过 webyep_sIncludePath 在(1)包括(a)WYApplication.php,(b)WYDocument.php,(c)WYEditor.php,(d)WYElement.php,(e)WYFile.php,(f)WYHTMLTag.php,(g)WYImage.php,(h)WYLanguage.php,(i)WYLink.php,(j)WYPath.php,(k)WYPopupWindowLink.php,(l)WYSelectMenu.php 和(m)WYTextArea.php 的文件中执行任意的PHP代码。(2)包括(n)WYGalleryElement.php,(o)WYGuestbookElement.php,(p)WYImageElement.php,(q)WYLogonButtonElement.php,(r)WYLongTextElement.php,(s)WYLoopElement.php,(t)WYMenuElement.php 和(u)WYShortTextElement.php 的文件，以及(3)programm/webyep.php。
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the webyep_sIncludePath in (1) files in the programm/lib/ directory including (a) WYApplication.php, (b) WYDocument.php, (c) WYEditor.php, (d) WYElement.php, (e) WYFile.php, (f) WYHTMLTag.php, (g) WYImage.php, (h) WYLanguage.php, (i) WYLink.php, (j) WYPath.php, (k) WYPopupWindowLink.php, (l) WYSelectMenu.php, and (m) WYTextArea.php; (2) files in the programm/elements/ directory including (n) WYGalleryElement.php, (o) WYGuestbookElement.php, (p) WYImageElement.php, (q) WYLogonButtonElement.php, (r) WYLongTextElement.php, (s) WYLoopElement.php, (t) WYMenuElement.php, and (u) WYShortTextElement.php; and (3) programm/webyep.php.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
WebYep 多个PHP远程文件包含漏洞
漏洞描述信息
MMWebYep 1.1.9中的多个PHP远程文件包含漏洞，在启用register_globals的情况下，远程攻击者可以通过(1)programm/lib/目录下的文件(其中包括(a)WYApplication.php，(b)WYDocument.php，(c)WYEditor.php，(d)WYElement.php，(e)WYFile.php，(f)WYHTMLTag.php，(g)WYImage.php，(h)WYLanguage.php，(i)WYLink.php，(j)WYPath.php，(
CVSS信息
N/A
漏洞类别
代码注入