CVE:CVE-2010-4835
CNNVD:CNNVD-201109-216
OneOrZero AIMS 2.6.0 Members Edition的index.php中存在目录遍历漏洞。远程认证用户可借助show_report操作中controller参数中的目录遍历序列读取任意文件。
solution:Upgrade oneorzero aims to a higher version than 2.6.0,and avoid the version 2.6.0