Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Unrestricted file upload vulnerability in index.php in phpBP RC3 (2.204) and earlier allows remote administrators to inject arbitrary PHP code into an upload/banners/ file via a banners add operation that uploads the PHP code through an image_form parameter specifying a multiple-extension filename such as .jpg.vil.gif.php, which is stored in upload/banners/ under a different name, and executable via a direct request. NOTE: a separate SQL injection issue could be leveraged to make this vulnerability reachable by remote unauthenticated attackers.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
phpBP 'index.php' RC3文件上传漏洞
Vulnerability Description
phpBP RC3(2.204)及之前版本的index.php中存在未限制文件上传漏洞。远程管理员可以借助一个标语添加操作，注入任意的PHP代码到upload/banners/文件。 该操作会通过图像格式参数，上传PHP代码。图像格式参数会详细说明一个多扩展名的文件名，比如.jpg.vil.gif.php。该漏洞会储存在不同的文件名下的upload/banners/中，借助一个直接请求就可以执行它。
CVSS Information
N/A
Vulnerability Type
N/A