| शीर्षक | DESHANG DSCMS <=3.1.2 Pre-Authentication Arbitrary File Download |
|---|
| विवरण | The DSCMS System version 3.1.2 and below is susceptible to a Pre-Authentication Arbitrary File Download vulnerability. This vulnerability arises from the 'public/install.php' file, where an attacker can manipulate the 'action' cookie to bypass installation checks and use the 'step' parameter to connect to an arbitrary MySQL server. When combined with the 'local infile' feature in PHP versions 7.1 and below, this can allow a malicious actor to load files from their rogue MySQL server, enabling them to read Phar files and potentially trigger deserialization, leading to further exploitation. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/xYQMsARg83ui |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 09/01/2024 02:59 AM (3 साल पहले) |
|---|
| संयम | 11/01/2024 11:23 AM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 250434 [DeShang DSCMS तक 3.1.2/7.1 public/install.php अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|