Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Vulnerability Type
N/A
Vulnerability Title
Tipask 安全漏洞
Vulnerability Description
Tipask是中国宋登峰（sdfsky）个人开发者的一款开放源码的 PHP 问答系统。 Tipask 3.5.9 之前版本存在安全漏洞，该漏洞源于用户输入的路径参数在下载附件时没有经过验证。攻击者利用该漏洞可以在Tipask服务器上下载任意文件如.env、/etc/passwd、laravel.log，造成信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A