BugTraq
New vulnerabilities in CMS SiteLogic Apr 26 2010 02:41PM
Salvatore Fresta aka Drosophila (drosophilaxxx gmail com)
On 26 April 2010 16:16, MustLive <mustlive (at) websecurity.com (dot) ua [email concealed]> wrote:
>
> It's not a problem for serious hackers. Even those commands which allowed on
> average server are enough for many things ;-).

So what? Also a SQL Injection vulnerability may be used to write a
file on the system to execute commands, but it isn't a remote commands
execution vulnerability. The your is not a command execution
vulnerability because there aren't injection on a command execution's
function, such as system(). If you can upload a file not allowed by
the vulnerable script, you can than upload a malicious file that can
be used to execute commands or other operations on the target server,
but it isn't a direct command execution vulnerability, understand? The
my is only a clarification.

--
Salvatore Fresta aka Drosophila
http://www.salvatorefresta.net
CWNP444351

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus