Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Directory traversal vulnerability in am.pl in (1) SQL-Ledger 2.6.27 and earlier, and (2) LedgerSMB before 1.2.0, allows remote attackers to run arbitrary executables and bypass authentication via a .. (dot dot) sequence and trailing NULL (%00) in the login parameter. NOTE: this issue was reportedly addressed in SQL-Ledger 2.6.27, however third-party researchers claim that the file is still executed even though an error is generated.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
LedgerSMB/SQL-Ledger am.pl 目录遍历漏洞
Vulnerability Description
(1)SQL-Ledger 2.6.27及之前版本和(2)LedgerSMB 1.2.0之前版本的am.pl中存在目录遍历漏洞。远程攻击者可以借助登陆参数中的..序列和拖动的空(%00)，运行任意可执行程序和绕过身份认证。
CVSS Information
N/A
Vulnerability Type
N/A