The remote version of Land Down Under is prone to several SQL injection and cross-site scripting attacks due to its failure to sanitize user-supplied input to several parameters used by the 'auth.php', 'events.php', 'index.php', 'list.php', and 'plug.php' scripts.  A malicious user can exploit exploit these flaws to manipulate SQL queries, steal authentication cookies, and the like.

Land Down Underのリモートバージョンは、「auth.php」、「events.php」、「index.php」、「list.php」、および「plug.php」スクリプトが使用するいくつかのパラメーターに対するユーザー指定の入力をサニタイズしないため、いくつかのSQLインジェクションおよびクロスサイトスクリプティング攻撃に脆弱です。悪意のあるユーザーがこれらの欠陥を悪用して、SQLクエリを操作したり、認証Cookieを盗んだりする可能性があります。

遠端的 Land Down Under 版本容易遭受數個 SQL 注入攻擊和跨網站指令碼攻擊，這是因為其無法清理「auth.php」、「events.php」、「index.php」、「list.php」和「plug.php」指令碼所使用的數個參數的使用者輸入資料。惡意使用者可利用這些弱點來操控 SQL 查詢、竊取驗證 Cookie 等。

The remote host is running Land Down Under, a web-based content management system.  This version of LDU is vulnerable to a script injection flaw within the 'events.php' script.  An attacker exploiting this flaw would need to be able to convince a user to browse to a malicious URI.  Successful exploitation would lead to script code being executed within the user's browser.  In addition, the product is vulnerable to multiple SQL injection flaws.  An attacker exploiting these flaws would be able to execute code within the context of the database.

ID	名稱	產品	系列	已發布	已更新	嚴重性
19603	Land Down Under <= 801 Multiple Vulnerabilities	Nessus	CGI abuses	2005/9/9	2024/6/5	high
19603	Land Down Under <= 801の複数の脆弱性	Nessus	CGI abuses	2005/9/9	2024/6/5	high
19603	Land Down Under <= 801 多個弱點	Nessus	CGI abuses	2005/9/9	2024/6/5	high
3209	Land Down Under < 802 events.php SQL Injection	Nessus Network Monitor	CGI	2005/9/7	2019/3/6	medium

偵測

搜尋 Plugin

high

high

high

medium