새로운 댓글
제로보드 검색 결과, 3
Zeroboard Download SQL Injection
요번에 제로보드의 DOwnload.php가 SQL injection 에 취약함을 발표했으며 그에 따른 보안패치를 올렸습니다. 여기에 대해 잠깐 언급해보겠습니다... http://target/bbs/download.php?id=notice&page=1&sn1=&divpage=1&sn=off&ss=on&sc=on &select_arrange=headnum&desc=asc&no=5&filenum=1=100/* ... 구문은 자기가 필요한 구문을 적절히 넣으면 된다.. update zetyx_board_notice set download1=100/*=download1=100/*+1 where no='5'\ Download.php 변경사항 mysql_query("update $t_board"."_$id set d..제로보드 파일 업로드 취약점 4.1 pl18 해당
Basically, the PHP, HTML, and CGI files are prohibited to upload in Zeroboard. But uploading of the other files which can modify the configuration of Apache such as .htaccess is not considered as a serious issue. Therefore, an unknown attacker can execute any malicious codes on the system and acquire system control also. * The FileType in the .htaccess can be modified by configuring the Override..