CVE-2018-16437

概要

参考情報

• bbs.gxlcms.com/forum.php · Mitigation
• ttk7.cn/post-78.html · Exploit

gxlcms のその他の脆弱性

• CVE-2020-20975緊急 9.8In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
• CVE-2018-18488緊急 9.8In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.
• CVE-2018-18487高 7.5In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in pred…
• CVE-2018-16655中 6.1Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.
• CVE-2018-16436高 7.2Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.