漏洞标题
N/A
漏洞描述信息
在Ekke Doerre Contenido 42VariablVersion (42VV10) 在mods 4 xoops Contenido eZ Publish(pdf4cms)上漏洞文章中，多个PHP远程文件包含漏洞被提及。这些漏洞允许远程攻击者通过cfgPathIn parameter中的路径名，执行任意PHP代码。这些路径包括：
1. main_upl.php
2. main_con_editside.php
3. main_news_rcp.php
4. main_mod.php
5. main_tplinput_edit.php
6. main_con.php
7. main_tpl.php
8. main_con_sidelist.php
9. main_str.php
10. main_news.php
11. main_tplinput.php
12. main_lang.php
13. main_mod_edit.php
14. main_lay.php
15. main_lay_edit.php
16. main_news_send.php
17. main_con_edittpl.php
18. main_stat.php
19. main_tpl_edit.php
20. main_news_edit.php
21. inc/upl_show_uploads.inc.php
其中(a)cfgPathContenido或(b)cfgPathTpl参数指向(22)con_show_sidelist.inc.php,(23)mod_show_modules.inc.php,(24)con_edit_form.inc.php,(25)lay_show_layouts.inc.php,(26)con_show_tree.inc.php,(27)news_show_newsletters.inc.php,(28)str_show_tree.inc.php,(29)tpl_show_templates.inc.php,(30)stat_show_tree.inc.php,(31)con_editcontent.inc.php，或(32)news_show_recipients.inc.php in inc/;
或者，该cfgPathTpl参数指向(33)main_user_md5.php3，或(34)actions_mod.php,(35)actions_lay.php,(36)actions_upl.php,(37)actions_stat.php,(38)actions_news.php,(39)actions_str.php,(40)header.php,(41)actions_con_sidelist.php,(42)main_top.inc.php,(43)actions_tpl.php，或(44)actions_con.php。
Note:vectors 21, 24, 26, 27, 32, 34, 35, 36, 37, 38, 39, 40, 41, 43, 44因CVE而受到争议，因为在请求文件时，PHP会直接遇到致命函数调用错误，而未能到达包含语句。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
Multiple PHP remote file inclusion vulnerabilities in Ekke Doerre Contenido 42VariablVersion (42VV10) in contenido_hacks in Mods 4 Xoops Contenido eZ publish (pdf4cms) allow remote attackers to execute arbitrary PHP code via a URL in the cfgPathInc parameter to (1) main_upl.php, (2) main_con_editside.php, (3) main_news_rcp.php, (4) main_mod.php, (5) main_tplinput_edit.php, (6) main_con.php, (7) main_tpl.php, (8) main_con_sidelist.php, (9) main_str.php, (10) main_news.php, (11) main_tplinput.php, (12) main_lang.php, (13) main_mod_edit.php, (14) main_lay.php, (15) main_lay_edit.php, (16) main_news_send.php, (17) main_con_edittpl.php, (18) main_stat.php, (19) main_tpl_edit.php, (20) main_news_edit.php, or (21) inc/upl_show_uploads.inc.php; the (a) cfgPathContenido or (b) cfgPathTpl parameter to (22) con_show_sidelist.inc.php, (23) mod_show_modules.inc.php, (24) con_edit_form.inc.php, (25) lay_show_layouts.inc.php, (26) con_show_tree.inc.php, (27) news_show_newsletters.inc.php, (28) str_show_tree.inc.php, (29) tpl_show_templates.inc.php, (30) stat_show_tree.inc.php, (31) con_editcontent.inc.php, or (32) news_show_recipients.inc.php in inc/; or the cfgPathTpl parameter to (33) main_user_md5.php3, or (34) actions_mod.php, (35) actions_lay.php, (36) actions_upl.php, (37) actions_stat.php, (38) actions_news.php, (39) actions_str.php, (40) header.php, (41) actions_con_sidelist.php, (42) main_top.inc.php, (43) actions_tpl.php, or (44) actions_con.php in tpl/. NOTE: vectors 21, 24, 26, 27, 32, 34, 35, 36, 37, 38, 39, 40, 41, 43, and 44 are disputed by CVE because PHP encounters a fatal function-call error on a direct request for the file, before reaching the include statement.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Ekke Ekke Doerre Mods 代码注入漏洞
漏洞描述信息
contenido_hacks中的Mods 4 Xoops Contenido eZ publish (pdf4cms)的Ekke Doerre Contenido 42VariablVersion (42VV10)存在多个PHP远程文件包含漏洞，远程攻击者可以借助以下文件中的参数的一个URL执行任意PHP代码： (1) main_upl.php, (2) main_con_editside.php, (3) main_news_rcp.php, (4) main_mod.php, (5) main_tp
CVSS信息
N/A
漏洞类别
代码注入