Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
_functions.php in cpCommerce 1.2.x, possibly including 1.2.9, sends a redirect but does not exit when it is called directly, which allows remote attackers to bypass a protection mechanism to conduct remote file inclusion and directory traversal attacks, execute arbitrary PHP code, or read arbitrary files via the GLOBALS[prefix] parameter, a different vector than CVE-2003-1500.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
cpCommerce '_functions.php' 远程文件包含和目录遍历漏洞
Vulnerability Description
cpCommerce 1.2.x版本以及可能包含的1.2.9版本中的_functions.php发送一个当它被直接调用时并不存在的重定向，这会允许远程攻击者可以借助GLOBALS[prefix]参数，绕过一个保护机制并执行远程文件包含和目录遍历攻击，同时执行人以PHP代码或读取任意文件。
CVSS Information
N/A
Vulnerability Type
N/A