en:In the implementation of the website, the filtering of input parameters is not strict, resulting in the illegal acquisition of the contents of the SQL database.
en:XSS flaws occur when new web pages for an application contain untrusted, improperly validated or escaped data, or when existing web pages are updated using browser APIs that can create HTML or JavaScript. XSS allows an attacker to execute script in a victim's browser and hijack user sessions, deface websites, or redirect users to malicious sites.
zh:当应用程序的新网页中包含不受信任的、未经恰当验证或转义的数据，或者使用可以创建 HTML 或 JavaScript 的浏览器 API更新现有的网页时，会出现 XSS 缺陷。XSS 让攻击者能够在受害者的浏览器中执行脚本，并劫持用户会话、破坏网站或将用户重定向到恶意站点。
en:A type of injection attack, including shell command injection, PHP code injection, Java code injection, etc. If the attacker successfully exploits it, it can cause the website to execute the code injected by the attacker.
en:An attacker could exploit this vulnerability to gain access to unauthorized files or directories, possibly resulting in the disclosure of sensitive information or the execution of arbitrary code.
en:When the uploaded file is disguised as a malicious script with a normal suffix, the attacker can use the local file inclusion vulnerability to execute the file.
zh:当上传文件伪装成正常后缀的恶意脚本时，攻击者可借助本地文件包含漏洞执行该文件。
rules:
-id:314001
level:2
name:UFL-BASE-1
type:UFL
description:未授权文件上传1
expr:(.*\.(php|php5|jsp|jspx|asp|aspx|asa))
mode:match(urlDecode(body_para['filename']))
-id:314002
level:2
name:UFL-BASE-2
type:UFL
description:未授权文件上传2
expr:(Content-Type:.*application/.*)
mode:match(urlDecode(substr(body_buf,0,1024)))
-id:314003
level:2
name:UFL-PHP-Webshell
type:UFL
description:疑似PHP webshell文件上传
expr:(<\?php.*)
mode:match(urlDecode(substr(body_buf,0,2028)))
status:0
-category_id:c_11
category:
en:Remote file inclusion detection
zh:远程文件包含检测
description:
en:Attackers read or execute unauthorized files, which may lead to disclosure of sensitive information or execute the file with the help of file inclusion vulnerabilities.
en:Due to the XML processor there is an external entity reference in the XML file. An attacker could use an external entity to steal internal and shared files using URI file handlers, listen on internal scan ports, execute remote code, and perform denial-of-service attacks.
zh:由于 XML 处理器在XML 文件中存在外部实体引用。攻击者可利用外部实体窃取使用 URI 文件处理器的内部文件和共享文件、监听内部扫描端口、执行远程代码和实施拒绝服务攻击。
