Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Directory traversal vulnerability in admin/skins.php for @lex Guestbook 4.0.2 and earlier allows remote attackers to create files in arbitrary directories via ".." sequences in the (1) aj_skin and (2) skin_edit parameters. NOTE: this can be leveraged for file inclusion by creating a skin file in the lang directory, then referencing that file via the lang parameter to index.php, which passes a sanity check in livre_include.php.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
lex Guestbook 'index.php' 目录遍历漏洞
Vulnerability Description
lex Guestbook 4.0.2及之前版本中存在多个目录遍历漏洞。远程攻击者可以借助提交到index.php的lang参数中的一个相对路径名，包含和运行任意的本地文件，借助提交到admin/skins.php的aj_skin和skin_edit参数，访问任意目录。
CVSS Information
N/A
Vulnerability Type
N/A