Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Directory traversal vulnerability in cafenews.php for CARE 2002 before beta 1.0.02 allows remote attackers to read arbitrary files via .. (dot dot) sequences and null characters in the lang parameter, which is processed by a call to the include function.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CARE 2002不安全文件包含输入验证错误漏洞
Vulnerability Description
CARE 2002是一款集成的健康护理一体软件，提供由PHP实现的WEB接口。 CARE 2002对用户的输入缺少正确的验证检查，远程攻击者可以利用这个漏洞以WEB服务进程权限在系统上查看任意文件内容。 ./main/cafenews.php脚本中存在包含的函数变量可以被用户控制： [...] include("../language/".$lang."/lang_".$lang."_newsdummy.php"); [...] 如果在php.ini配置文件中'register_globals'变量设置为
CVSS Information
N/A
Vulnerability Type
N/A