Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entries.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CVSTrac远程拒绝服务漏洞
Vulnerability Description
CVSTrac是一个为CVS设计的补丁和错误跟踪系统。 CVSTrac在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞执行拒绝服务攻击。CVSTrac的format.c文件中is_eow()函数没有检查用户提供字符串的first(!)字符中的End-Of-Word终止字符，而是迭代字符串，这可能允许跳过单个嵌入的问号。然后is_repository_file()函数假设文件名字符串中不会包含单个问号，因此可能出现SQL转义问题。但由于is_eow()处理空格的方式，尽管攻击者可以执行SQL注入攻
CVSS Information
N/A
Vulnerability Type
N/A