Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Multiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences and a NUL (%00) character in (1) the newlang parameter and (2) the installlang parameter in a cookie, as demonstrated by using error.php to insert malicious code into a log file, or uploading a malicious .png file, which is then included using install.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CPG Dragonfly CMS多个目录遍历漏洞
Vulnerability Description
CPG-Nuke Dragonfly CMS(即CPG Dragonfly CMS)9.0.6.1的install.php中存在多个目录遍历漏洞。远程攻击者可以借助目录遍历序列和cookie中(1) newlang参数和(2) installlang参数的NUL (%00)字符包含并执行任意本地文件(如演示过程中，使用error.php向日志文件中插入恶意代码，或上传随后被install.php包含的恶意.png文件)。
CVSS Information
N/A
Vulnerability Type
N/A