Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Directory traversal vulnerability in the get_lang function in global.php in Quicksilver Forums 1.4.2 and earlier, as used in QSF Portal before 1.4.5, when running on Windows, allows remote attackers to include and execute arbitrary local files via a "\" (backslash) in the lang parameter to index.php, which bypasses a protection mechanism that only checks for "/" (forward slash), as demonstrated by uploading and including PHP code in an avatar file.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Quicksilver Forums本地文件包含和任意文件上传漏洞
Vulnerability Description
当在Windows上运行时，在QSF Portal 1.4.5之前版本中使用的Quicksilver Forums 1.4.2及之前版本中的global.php的get_lang函数中存在目录遍历漏洞。远程攻击者可以借助到index.php的lang参数中的“\”，包含并执行任意本地文件，这会绕过保护机制，因为该保护机制只验证“/”。
CVSS Information
N/A
Vulnerability Type
N/A