CVE-2018-16655

概要

参考情報

• lengjibo/lengjibo.github.io · Exploit
• lengjibo.github.io/gxlcms · Third Party Advisory

gxlcms のその他の脆弱性

• CVE-2020-20975緊急 9.8In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
• CVE-2018-18488緊急 9.8In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.
• CVE-2018-18487高 7.5In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in pred…
• CVE-2018-16437中 4.9Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.
• CVE-2018-16436高 7.2Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.