漏洞标题
N/A
漏洞描述信息
在Tateke Nutma Foing中，在Fully Modded phpBB (phpbbfm) 2021.4.40 和更早版本中，存在多个PHP远程文件包含漏洞，允许远程攻击者通过(a) faq.php,(b) index.php,(c) list.php,(d) login.php,(e) playlist.php,(f) song.php,(g) gen_m3u.php,(h) view_artist.php,(i) view_song.php,(j) flash/set_na.php,(k) flash/initialise.php,(l) flash/get_song.php,(m) includes/common.php,(n) admin/nav.php,(o) admin/main.php,(p) admin/list_artists.php,(q) admin/index.php,(r) admin/genres.php,(s) admin/edit_artist.php,(t) admin/edit_album.php,(u) admin/config.php,(v) admin/admin_status.php在 player/ 中的不同传播方式，与 CVE-2006-3045 不同。注意：到 20061026 为止，CVE 分析显示，在 admin/ 和 flash/ 目录中的文件在使用前定义了 foing_root_path。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Multiple PHP remote file inclusion vulnerabilities in Teake Nutma Foing, as modified in Fully Modded phpBB (phpbbfm) 2021.4.40 and earlier, allow remote attackers to execute arbitrary PHP code via a URL in the foing_root_path parameter in (a) faq.php, (b) index.php, (c) list.php, (d) login.php, (e) playlist.php, (f) song.php, (g) gen_m3u.php, (h) view_artist.php, (i) view_song.php, (j) flash/set_na.php, (k) flash/initialise.php, (l) flash/get_song.php, (m) includes/common.php, (n) admin/nav.php, (o) admin/main.php, (p) admin/list_artists.php, (q) admin/index.php, (r) admin/genres.php, (s) admin/edit_artist.php, (t) admin/edit_album.php, (u) admin/config.php, and (v) admin/admin_status.php in player/, different vectors than CVE-2006-3045. NOTE: CVE analysis as of 20061026 indicates that files in the admin/ and flash/ directories define foing_root_path before use.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Fully Modded phpBB Teake Nutma Foing多个PHP远程文件包含漏洞
漏洞描述信息
当Teake Nutma Foing在Fully Modded phpBB (phpbbfm) 2021.4.40和更早的版本中修改时存在多个PHP远程文件包含漏洞，远程攻击者可以通过player/目录下(a)faq.php，(b)index.php，(c)list.php，(d)login.php，(e)playlist.php，(f)song.php，(g)gen_m3u.php，(h)view_artist.php，(i)view_song.php，(j)flash/set_na.php，(k)fl
CVSS信息
N/A
漏洞类别
授权问题