Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
YABB SE多个输入验证漏洞
Vulnerability Description
YABB SE是一款基于PHP/MySQL的论坛程序。 YABB SE由于不正确的输入验证，远程攻击者可以利用这些漏洞进行SQL注入和目录遍历攻击。 SQL注入漏洞存在于ModifyMessage函数中，由于对$msg参数没有进行任何输入检查，因此可造成SQL注入攻击。造成敏感信息泄露和数据库信息删除。 目录遍历攻击是由于ModifyMessage函数没有对用户提交给$attachOld参数包含"../"字符的数据缺少过滤，攻击者可能以WEB进程权限查看系统任意文件内容。
CVSS Information
N/A
Vulnerability Type
N/A