VULHUB ™

PMB Services 3.0.13及之前版本中存在多个PHP远程文件包含漏洞。远程攻击者可以借助提交到(a)includes/resa_func.inc.php，(b)admin/notices/perso.inc.php或(c)admin/quotas/main.inc.php的(1)class_path参数、到(d)opac_css/rec_panier.php或(e) opac_css/includes/author_see.inc.php的(2)base_path参数或到(f)bull_info.inc.php或(g) misc.inc.php；(h) options_date_box.php,(i)options_file_box.php,(j)options_list.php,(k)options_query_list.php或(l)options_text.php，(m)options.php,(n)options_comment.php,(o)options_date_box.php,(p)options_list.php,(q)options_query_list.php或(r)options_text.php ，(s)admin/import/iimport_expl.php,(t)admin/netbase/clean.php,(u)admin/param/param_func.inc.php,(v)admin/sauvegarde/lieux.inc.php,(w) autorites.php,(x)account.php,(y)cart.php或(z)edit.php的(3)include_path参数中的一个URL，执行任意的PHP代码。

PMB Services 3.0.13及之前版本中存在多个PHP远程文件包含漏洞。远程攻击者可以借助提交到(a)includes/resa_func.inc.php，(b)admin/notices/perso.inc.php或(c)admin/quotas/main.inc.php的(1)class_path参数、到(d)opac_css/rec_panier.php或(e) opac_css/includes/author_see.inc.php的(2)base_path参数或到(f)bull_info.inc.php或(g) misc.inc.php；(h) options_date_box.php,(i)options_file_box.php,(j)options_list.php,(k)options_query_list.php或(l)options_text.php，(m)options.php,(n)options_comment.php,(o)options_date_box.php,(p)options_list.php,(q)options_query_list.php或(r)options_text.php ，(s)admin/import/iimport_expl.php,(t)admin/netbase/clean.php,(u)admin/param/param_func.inc.php,(v)admin/sauvegarde/lieux.inc.php,(w) autorites.php,(x)account.php,(y)cart.php或(z)edit.php的(3)include_path参数中的一个URL，执行任意的PHP代码。