eyoucms 漏洞列表

EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function.

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function.

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.

EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.

Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.

EyouCMS installation is exposed.

EyouCms是基于TP5.0框架为核心开发的稳定+开源的企业内容管理系统，可适用于各种行业二次开发。eyoucms存在弱口令登录，攻击者可以通过暴力破解进去到用户系统造成系统破坏

EyouCms是基于TP5.0框架为核心开发的免费开源的企业内容管理系统、专注企业建站用户需求提供海量各行业模板。EyouCms存在后台代码执行漏洞，可被获取服务器权限。

EyouCms是基于TP5.0框架为核心开发的免费开源的企业内容管理系统、专注企业建站用户需求提供海量各行业模板，EyouCms存在信息泄露漏洞,攻击者可以根据该漏洞获取大量敏感信息。

EyouCMS存在目录遍历漏洞，此漏洞是缺乏校验导致的。

Eyoucms 跨站请求伪造漏洞(CVE-2022-36225)

Eyoucms 跨站脚本攻击漏洞(CVE-2022-35509)

EyouCms是基于TP5.0框架为核心开发的免费开源的企业内容管理系统、专注企业建站用户需求提供海量各行业模板，该漏洞存在后台登录绕过，用户可获取修改session进入后台。

【漏洞对象】eyoucms v1.0 【涉及版本】 eyoucms v1.0 【漏洞描述】易优内容管理系统(EyouCms)以模板多、易优化、开源而闻名，是国内新锐的PHP开源网站管理系统。其1.0版本与上传图片相关代码页Uploadify.php存在漏洞，攻击者可以在未授权的情况下直接往/index.php/api/Uploadify/preview页面上传php代码的base64编码，即可成功上传webshell，获取服务器权限，对服务器在成极大威胁。