CVE-2018-16655

Description

References

• lengjibo/lengjibo.github.io · Exploit
• lengjibo.github.io/gxlcms · Third Party Advisory

gxlcms의 다른 취약점

• CVE-2020-20975심각 9.8In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
• CVE-2018-18488심각 9.8In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, SQL Injection exists via the ids[] parameter.
• CVE-2018-18487높음 7.5In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in pred…
• CVE-2018-16437보통 4.9Gxlcms 2.0 before bug fix 20180915 has Directory Traversal exploitable by an administrator.
• CVE-2018-16436높음 7.2Gxlcms 2.0 before bug fix 20180915 has SQL Injection exploitable by an administrator.