Bugtraq mailing list archives
New vulnerabilities in CMS SiteLogic
From: Salvatore Fresta aka Drosophila <drosophilaxxx () gmail com>
Date: Mon, 26 Apr 2010 16:41:34 +0200
On 26 April 2010 16:16, MustLive <mustlive () websecurity com ua> wrote:
It's not a problem for serious hackers. Even those commands which allowed on average server are enough for many things ;-).
So what? Also a SQL Injection vulnerability may be used to write a file on the system to execute commands, but it isn't a remote commands execution vulnerability. The your is not a command execution vulnerability because there aren't injection on a command execution's function, such as system(). If you can upload a file not allowed by the vulnerable script, you can than upload a malicious file that can be used to execute commands or other operations on the target server, but it isn't a direct command execution vulnerability, understand? The my is only a clarification. -- Salvatore Fresta aka Drosophila http://www.salvatorefresta.net CWNP444351
Current thread:
- [Suspected Spam]New vulnerabilities in CMS SiteLogic MustLive (Apr 19)
- Re: [Suspected Spam]New vulnerabilities in CMS SiteLogic Salvatore Fresta aka Drosophila (Apr 20)
- Re: New vulnerabilities in CMS SiteLogic MustLive (Apr 26)
- Message not available
- New vulnerabilities in CMS SiteLogic Salvatore Fresta aka Drosophila (Apr 26)
- Re: New vulnerabilities in CMS SiteLogic MustLive (Apr 26)
- Re: [Suspected Spam]New vulnerabilities in CMS SiteLogic Salvatore Fresta aka Drosophila (Apr 20)