search
Homephp教程php手册PHP Advanced Transfer Manager多个漏洞

PHP Advanced Transfer Manager多个漏洞

Jun 13, 2016 am 10:10 AM
managerphpinformationMultipleSafetysupplyloopholes

信息提供: 安全公告(或线索)提供热线:51cto.editor@gmail.com
漏洞类别: 输入确认漏洞
攻击类型: 远程攻击
发布日期: 2005-09-20
更新日期: 2005-09-20
受影响系统: PHP Advanced Transfer Manager 1.x
安全系统: 无
漏洞报告人: rgod
漏洞描述: Secunia Advisory: SA16867
PHP Advanced Transfer Manager复合漏洞
rgod已经报道了在PHP Advanced Transfer Manager中的一些漏洞和安全问题。恶意攻击者利用漏洞可能泄露系统信息和一些敏感信息,也可能执行交叉脚本攻击。
1.在用来显示文件之前,在"txt.php", "htm.php", "html.php"和"zip.php"中"current_dir" 和 "filename"参数的输入无效。攻击者利用漏洞通过目录障碍攻击泄露恶意文件的内容。
2.攻击者利用漏洞通过直接访问"test.php"脚本可能泄露某些PHP配置设置。
3.在反馈给用户之前,在"txt.php" 中"font", "normalfontcolor" 和"mess[31]"参数的输入无效。当用户浏览受影响的网络时,攻击者利用漏洞执行恶意HTML代码和恶意脚本代码。
在PHP Advanced Transfer Manager 1.30版本中发现漏洞和安全问题,其他版本也可能受到影响。
测试方法: 无
解决方法: 编辑代码确认输入有效,并限制访问"test.php"脚本。
程序下载:http://phpatm.free.fr/archive/phpATM_130.zip
 

Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

VSCode Windows 64-bit Download

VSCode Windows 64-bit Download

A free and powerful IDE editor launched by Microsoft

MantisBT

MantisBT

Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

PhpStorm Mac version

PhpStorm Mac version

The latest (2018.2.1) professional PHP integrated development tool

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

mPDF

mPDF

mPDF is a PHP library that can generate PDF files from UTF-8 encoded HTML. The original author, Ian Back, wrote mPDF to output PDF files "on the fly" from his website and handle different languages. It is slower than original scripts like HTML2FPDF and produces larger files when using Unicode fonts, but supports CSS styles etc. and has a lot of enhancements. Supports almost all languages, including RTL (Arabic and Hebrew) and CJK (Chinese, Japanese and Korean). Supports nested block-level elements (such as P, DIV),