PHPSlash URL块任意文件泄露漏洞

PHPSlash 0.6.1版本的Block_render_url.class存在漏洞。有PHPSlash管理员特权的远程攻击者通过创建空心块和指定目标文件为源URL读取任意文件。

The vendor has addressed the problem and a patch submitted by tobozo tagada is available for download.
@iol.ie>

来源: marc.theaimsgroup.com
链接:http://marc.theaimsgroup.com/?l=phpslash&m=99029398904419&w=2

来源: BID
名称: 2724
链接:http://www.securityfocus.com/bid/2724

来源: XF
名称: phpslash-block-read-files(9990)
链接:http://www.iss.net/security_center/static/9990.php

来源: BUGTRAQ
名称: 20010515 PHPSlash : potential vulnerability in URL blocks
链接:http://archives.neohapsis.com/archives/bugtraq/2001-05/0126.html