Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Direct static code injection vulnerability in CJ Tag Board 3.0 allows remote attackers to execute arbitrary PHP code via the (1) User-Agent HTTP header in tag.php, which is executed by all.php, and (2) the banned parameter in admin_index.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CJ Tag Board PHP远程代码注入漏洞
Vulnerability Description
CJ Tag Board是一款简单易用的网站管理脚本。 CJ Tag Board中存在两个输入验证错误，可能允许恶意攻击者完全入侵有漏洞的系统： 1) 在存储前没有正确过滤对tag.php中User-Agent HTTP头的输入，允许注入任意PHP代码。当用户请求all.php脚本时就会执行这些代码。 2) 在存储前没有正确过滤对admin_index.php中banned参数的输入，允许注入任意PHP代码。但利用这个漏洞需要管理用户权限。
CVSS Information
N/A
Vulnerability Type
N/A