| शीर्षक | Leadshop Leadshop <=1.4.20 Configuration injection vulnerability |
|---|
| विवरण | The Leadshop software, version 1.4.20 and below, has a pre-authentication configuration injection vulnerability in the 'leadshop.php' file that can lead to Remote Code Execution (RCE). The vulnerability arises from the 'install' function which accepts user-supplied parameters and writes them into the configuration php file. By crafting malicious parameters, such as in the MySQL database password, an attacker can inject arbitrary PHP code into the application's configuration file, leading to RCE when the file is included and executed in the application's context. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/vLswXhWxUrs8 |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 19/01/2024 11:53 AM (3 साल पहले) |
|---|
| संयम | 19/01/2024 01:02 PM (1 hour later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 251562 [Hecheng Leadshop तक 1.4.20 /web/leadshop.php install अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|