Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
plugins/maps/db_handler.php in LinPHA 1.3.3 and earlier does not require authentication for a settings action that modifies the configuration file, which allows remote attackers to conduct directory traversal attacks and execute arbitrary local files by placing directory traversal sequences into the maps_type configuration setting, and then sending a request to maps_view.php, which causes plugins/maps/map.main.class.php to use the modified configuration.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
LinPHA Maps Plugin 'db_handler.php'目录遍历漏洞
Vulnerability Description
plugins/maps/db_handler.php in LinPHA 1.3.3及其早期版本中修改配置文件的设置操作并不要求权限认证，远程攻击者通过把目录遍历序列放进maps_type 配置设置中然后再发送一个请求到maps_view.php使plugins/maps/map.main.class.php使用修改过的设置，以实施目录遍历攻击和执行任意本地文件。
CVSS Information
N/A
Vulnerability Type
N/A