lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 26 Apr 2010 16:41:34 +0200 From: Salvatore Fresta aka Drosophila <drosophilaxxx@...il.com> To: MustLive <mustlive@...security.com.ua> Cc: Bugtraq <bugtraq@...urityfocus.com> Subject: New vulnerabilities in CMS SiteLogic On 26 April 2010 16:16, MustLive <mustlive@...security.com.ua> wrote: > > It's not a problem for serious hackers. Even those commands which allowed on > average server are enough for many things ;-). So what? Also a SQL Injection vulnerability may be used to write a file on the system to execute commands, but it isn't a remote commands execution vulnerability. The your is not a command execution vulnerability because there aren't injection on a command execution's function, such as system(). If you can upload a file not allowed by the vulnerable script, you can than upload a malicious file that can be used to execute commands or other operations on the target server, but it isn't a direct command execution vulnerability, understand? The my is only a clarification. -- Salvatore Fresta aka Drosophila http://www.salvatorefresta.net CWNP444351
Powered by blists - more mailing lists