Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to admin/database.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
WebSPELL 'Database.PHP'认证绕过漏洞
Vulnerability Description
WebSPELL 4.01.01及更早版本中的src/index.php，在启用register_globals时，可让远程攻击者通过对admin/database.php执行写入操作时修改的userID参数来绕过认证并获取存储在数据库中的敏感信息。
CVSS Information
N/A
Vulnerability Type
N/A