'

漏洞组件 — Xoops

漏洞详情：
利用 PHP＋MySQL 编写的面向对象的可扩展智能建站门户系统 XOOPS 作为开源社区一个优秀的内容管理系统，自它面世起就一直受到人们的关注。其主要特征包括系统功能模块化，界面设计模板化，安装使用管理简洁明了，功能完善。 相对于其他 CMS，XOOPS 有完善的权限管理，可以对不同用户群组赋予不同的使用或管理权限。XOOPS 代码规范，注重安全性，极少被发现有安全漏洞；结构设计合理，易于作二次开发。作为理想的开发系统，被广泛用于个人网站、社区交流、公司企业以及各类大型门户系统。 XOOPS 社区开发活跃，各类功能模块可有不同选择，包括：新闻发布系统、文章管理、论坛、相册、资源下载、友情链接、广告/黄页管理、在线购物等传统模块，近来并有各种新型类别如 BLOG、WIKI、RSS 在线阅读/采集等。 作为一个功能强大的 CMS 系统，得益于其结构设计合理，XOOPS 除了本身的各类功能模块之外，可以很方便的集成现有的软件，比著名的 BLOG 程序 WORDPRESS、购物系统 OSCOMMERCE/ZEN-CART、图片管理程序 GALLERY等已经被集成到 XOOPS 中。BLOG.XOOPS.ORG.CN 就是使用了 WORDPRESS FOR XOOPS 中文。 XOOPS 的发布按照 GPL (GNU General Public License) 协议，在遵守GPL条款的前提下可以在任何场合免费使用和修改。

相关漏洞

SSV ID 漏洞名称
SSV-91313 Xoops 2.5.7.2 - Directory Traversal Bypass
SSV-91312 Xoops 2.5.7.2 - Arbitrary User Deletions CSRF
SSV-60071 XOOPS 2.5.4 Multiple XSS Vulnerabilities
SSV-26045 Xoops 2.5.4 Blind SQL Injection Vulnerability
SSV-19742 xoops tad_uploader模块上传漏洞
SSV-18973 XOOPS任意文件删除和HTTP头注入漏洞
SSV-15189 XOOPS include/notification_update.php页面SQL注入漏洞
SSV-15188 XOOPS modules/pm/readpmsg.php页面跨站脚本漏洞
SSV-18845 XOOPS Module dictionary 2.0.18 (detail.php) SQL Injection Vulnerability
SSV-87819 xoops 2.0.14 article.php Sql注入漏洞
SSV-87814 xoops 1.02 print.php Sql注入漏洞
SSV-87821 xoops 2.3.2 代码执行漏洞
SSV-18350 XOOPS SmartMedia 0.85 Module XSS
SSV-12654 Xoops用户配置文件激活安全绕过漏洞
SSV-11896 XOOPS Celepar Module Qas (bSQL/XSS) Multiple Remote Vulnerabilities
SSV-11884 Xoops Celepar Module Qas (codigo) SQL Injection Vulnerability
SSV-11643 XOOPS <= 2.3.3 Remote File Disclosure Vulnerability (.htaccess)
SSV-4652 XOOPS mydirname参数多个PHP代码注入漏洞
SSV-17698 XOOPS Module tadbook2 (open_book.php book_sn) SQL Injection Vuln
SSV-10433 XOOPS 2.3.2 (mydirname) Remote PHP Code Execution Exploit
SSV-17637 XOOPS Module Amevents (print.php id) SQL Injection Vulnerability
SSV-10201 XOOPS 2.3.1 Multiple Local File Inclusion Vulnerabilities
SSV-4317 Xoops个人消息系统跨站脚本执行(CSS/XSS)漏洞
SSV-4318 Xoops远程SQLInjection漏洞
SSV-9771 XOOPS Module makale Remote SQL Injection Vulnerability
SSV-9752 XOOPS Module GesGaleri (kategorino) Remote SQL Injection Exploit
SSV-9723 XOOPS Module xhresim (index.php no) Remote SQL Injection Vulnerability
SSV-17429 XOOPS Module xhresim (index.php no) Remote SQL Injection Vuln
SSV-9386 XoopsDownload3000 / Cross Siting Scripting
SSV-3708 Xoops本地文件包含和跨站脚本漏洞
SSV-3405 XOOPS Uploader上传模块'filename'参数目录遍历漏洞
SSV-8685 XOOPS Module Uploader 1.1 (filename) File Disclosure Vulnerability
SSV-8362 XOOPS Module Recipe (detail.php id) SQL Injection Vulnerability
SSV-8351 XOOPS Module Recipe (detail.php id) Remote SQL Injection Exploit
SSV-7939 XOOPS Module Dictionary <= 0.94 Remote SQL Injection Vulnerability
SSV-7983 XOOPS Module tutorials (printpage.php) SQL Injection Vulnerability
SSV-7987 XOOPS Module Gallery 0.2.2 (gid) Remote SQL Injection Vulnerability
SSV-7986 XOOPS Module My_eGallery 3.04 (gid) SQL Injection Vulnerability
SSV-7965 XOOPS Module Glossario 2.2 (sid) Remote SQL Injection Vulnerability
SSV-7966 XOOPS Module wfdownloads (cid) Remote SQL Injection Vulnerability
SSV-8130 XOOPS Module myTopics (articleid) Remote SQL Injection Vulnerability
SSV-8126 XOOPS Module eEmpregos (cid) Remote SQL Injection Vulnerability
SSV-8125 XOOPS Module classifieds (cid) Remote SQL Injection Vulnerability
SSV-8065 XOOPS 2.0.18 Local File Inclusion / URL Redirecting Vulnerabilities
SSV-2793 Xoops XoopsGallery Module 'init_basic.php'远程文件包含漏洞
SSV-7799 XOOPS mod_gallery Zend_Hash_key + Extract RFI Vulnerability
SSV-6954 XOOPS Module WiwiMod 0.4 Remote File Inclusion Vulnerability
SSV-1885 Xoops XT-Conteudo模块Spaw_Control.Class.PHP远程文件包含漏洞
SSV-1876 Xoops XFsection模块Dir_Module参数远程文件包含漏洞
SSV-6943 XOOPS Module XT-Conteudo (spaw_root) RFI Vulnerability
SSV-6944 XOOPS Module XFsection (modify.php) Remote File Inclusion Vulnerability
SSV-6942 XOOPS Module Cjay Content 3 Remote File Inclusion Vulnerability
SSV-6935 XOOPS Module Horoscope 1.0 Remote File Inclusion Vulnerability
SSV-6934 XOOPS Module TinyContent 1.5 Remote File Inclusion Vulnerability
SSV-17035 XOOPS Module Horoscope <= 2.0 Remote File Inclusion Vulnerability
SSV-1842 Xoops iContent模块Spaw_Control.Class.PHP远程文件包含漏洞
SSV-6896 XOOPS Module icontent 1.0 Remote File Inclusion Exploit
SSV-17029 XOOPS Module icontent 1.0/4.5 Remote File Inclusion Exploit
SSV-6817 XOOPS Module resmanager <= 1.21 BLIND SQL Injection Exploit
SSV-6819 XOOPS Module MyConference 1.0 (index.php) SQL Injection Exploit
SSV-6818 XOOPS Module Glossarie <= 1.7 (sid) Remote SQL Injection Exploit
SSV-6766 XOOPS Module wfquotes 1.0 0 Remote SQL Injection Vulnerability
SSV-6757 XOOPS Flashgames Module 1.0.1 Remote SQL Injection Vulnerability
SSV-1643 XOOPS TeamSpeak Display TSDisplay4xoops_block2.PHP远程文件包含漏洞
SSV-6650 XOOPS Module tsdisplay4xoops 0.1 Remote File Inclusion Vulnerability
SSV-1612 XOOPS Rha7 Downloads Module Visit.PHP SQL注入漏洞
SSV-6591 XOOPS Module WF-Links <= 1.03 (cid) Remote SQL Injection Exploit
SSV-6588 XOOPS Module Jobs <= 2.4 (cid) Remote SQL Injection Exploit
SSV-16963 XOOPS Module Jobs &lt;= 2.4 (cid) Remote SQL Injection Exploit
SSV-16957 XOOPS Module WF-Snippets &lt;= 1.02 (c) BLIND SQL Injection Exploit
SSV-6577 Xoops Module PopnupBlog &lt;= 2.52 (postid) BLIND SQL Injection Exploit
SSV-6580 Xoops Module WF-Section &lt;= 1.01 (articleid) SQL Injection Exploit
SSV-6579 Xoops Module XFsection &lt;= 1.07 (articleid) BLIND SQL Injection Exploit
SSV-16959 XOOPS Module Rha7 Downloads 1.0 (visit.php) SQL Injection Exploit
SSV-6563 Xoops Module WF-Section <= 1.01 (articleid) SQL Injection Exploit
SSV-6564 Xoops Module Virii Info &lt;= 1.10 (index.php) Remote File Include Exploit
SSV-6560 Xoops Module Zmagazine 1.0 (print.php) Remote SQL Injection Exploit
SSV-1595 XOOPS Module Repository ViewCat.PHP SQL注入漏洞
SSV-6562 Xoops Module XFsection <= 1.07 (articleid) BLIND SQL Injection Exploit
SSV-6558 Xoops Module Repository (viewcat.php) Remote SQL Injection Exploit
SSV-6551 Xoops Module eCal <= 2.24 (display.php) Remote SQL Injection Exploit
SSV-6548 Xoops Module Kshop <= 1.17 (id) Remote SQL Injection Exploit
SSV-6549 Xoops Module Tiny Event <= 1.01 (id) Remote SQL Injection Exploit
SSV-6543 Xoops Module myAlbum-P <= 2.0 (cid) Remote SQL Injection Exploit
SSV-6546 Xoops Module Camportail <= 1.1 (camid) Remote SQL Injection Exploit
SSV-6541 Xoops Module RM+Soft Gallery 1.0 BLIND SQL Injection Exploit
SSV-6545 Xoops Module debaser <= 0.92 (genre.php) BLIND SQL Injection Exploit
SSV-6554 Xoops Module Library (viewcat.php) Remote SQL Injection Exploit
SSV-6552 Xoops Module Core (viewcat.php) Remote SQL Injection Exploit
SSV-16953 XOOPS Module XFsection &lt;= 1.07 (articleid) BLIND SQL Injection Exploit
SSV-6555 Xoops Module Lykos Reviews 1.00 (index.php) SQL Injection Exploit
SSV-16947 XOOPS Module eCal &lt;= 2.24 (display.php) Remote SQL Injection Exploit
SSV-16952 XOOPS Module myAlbum-P &lt;= 2.0 (cid) Remote SQL Injection Exploit
SSV-16948 XOOPS Module Tiny Event &lt;= 1.01 (id) Remote SQL Injection Exploit
SSV-16950 XOOPS Module Camportail &lt;= 1.1 (camid) Remote SQL Injection Exploit
SSV-16949 XOOPS Module Kshop &lt;= 1.17 (id) Remote SQL Injection Exploit
SSV-16951 XOOPS Module debaser &lt;= 0.92 (genre.php) BLIND SQL Injection Exploit
SSV-16946 XOOPS Module Tutoriais (viewcat.php) Remote SQL Injection Exploit
SSV-6528 Xoops Module MyAds Bug Fix <= 2.04jp (index.php) SQL Injection Exploit
SSV-6517 Xoops Module Friendfinder <= 3.3 (view.php id) SQL Injection Exploit
京ICP备10040895号 京公网安备 11010502034610号 Copyright @ 404 Team from Knownsec. English