| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| geshi | = 1.0.0= 1.0.1= 1.0.2= 1.0.2_beta_1= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 1.0.7= 1.0.7.1= 1.0.7.10= 1.0.7.11= 1.0.7.12= 1.0.7.13= 1.0.7.14= 1.0.7.15= 1.0.7.16= 1.0.7.17= 1.0.7.18= 1.0.7.19= 1.0.7.2= 1.0.7.20= 1.0.7.21= 1.0.7.22= 1.0.7.3= 1.0.7.4= 1.0.7.5= 1.0.7.6= 1.0.7.7= 1.0.7.8= 1.0.7.9≤ 1.0.8 |
The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí