Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Snuffleupagus vulnerable to RCE on instances with upload validation enabled but without the VLD package
Vulnerability Description
Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a virtual patching system. On deployments of Snuffleupagus prior to version 0.13.0 with the non-default upload validation feature enabled and configured to use one of the upstream validation scripts based on Vulcan Logic Disassembler (VLD) while the VLD extension is not available to the CLI SAPI, all files from multipart POST requests are evaluated as PHP code. The issue was fixed in version 0.13.0.
CVSS Information
N/A
Vulnerability Type
未能安全地进行程序失效(Failing Open)
Vulnerability Title
Snuffleupagus 安全漏洞
Vulnerability Description
Snuffleupagus是Julien Voisin个人开发者的一个安全模块。 Snuffleupagus 0.13.0之前版本存在安全漏洞，该漏洞源于上传验证功能配置不当，可能导致多部分POST请求中的文件被评估为PHP代码。
CVSS Information
N/A
Vulnerability Type
N/A