Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allow_url_fopen' setting is enabled via a URL in the config_atkroot parameter that points to the code.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Achievo远程文件包含命令执行漏洞
Vulnerability Description
Achievo是一款基于WEB的用于商业环境的项目管理工具。 Achievo中的class.atkdateattribute.js.php脚本在包含文件时没有正确验证包含文件路径，远程攻击者可以利用这个漏洞以Achievo用户权限在系统上执行任意命令。 Achievo中的atk/javascript/class.atkdateattribute.js.php脚本用于生成JavaScript代码，这个文件包含5个include_once变量，用于装载配置数据和功能函数，但引用包含文件时没有对文件路径进行正确
CVSS Information
N/A
Vulnerability Type
N/A