Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
c32web.exe in McMurtrey/Whitaker Cart32 before 6.4 allows remote attackers to read arbitrary files via the ImageName parameter in a GetImage action, by appending a NULL byte (%00) sequence followed by an image file extension, as demonstrated by a request for a ".txt%00.gif" file. NOTE: this might be a directory traversal vulnerability.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
McMurtrey/Whitaker Cart32 'c32web.exe' 文件请求漏洞
Vulnerability Description
McMurtrey/Whitaker Cart32版本之前的版本6.4中的c32web.exe允许远程攻击者可以借助一个GetImage操作中的ImageName 参数读取任意文件,该参数在一个图像文件扩展名后附加医药股 NULL byte (%00)序列。例如一个".txt%00.gif"文件中的一个请求。
CVSS Information
N/A
Vulnerability Type
N/A