Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Limbo CMS 1.0.4.2 and earlier, with register_globals off, does not protect the $_SERVER variable from external modification, which allows remote attackers to use the _SERVER[REMOTE_ADDR] parameter to (1) conduct cross-site scripting (XSS) attacks in the stats module or (2) execute arbitrary code via an eval injection attack in the wrapper option in index2.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Limbo CMS多个输入验证漏洞
Vulnerability Description
Limbo CMS 1.0.4.2及更早版本在register_globals off的情况下不能防止从外部修改$_SERVER变量，远程攻击者可以通过index2.php wrapper选项中的eval注入攻击，使用_SERVER[REMOTE_ADDR]参数(1)在stats模块中实施跨站脚本(XSS)攻击或(2)执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A