CVE:CVE-2008-3555
CNNVD:CNNVD-200808-104
WSN多个Web系统(WSN Forum 4.1.43以及之前的版本，Gallery 4.1.30以及之前的版本，Knowledge Base (WSNKB) 4.1.36以及之前的版本，Links 4.1.44以及之前的版本，Classifieds 4.1.30之前的版本)中的index.php存在目录遍历漏洞。
远程攻击者可以借助TID参数中的".."，放入和运行任意的本地文件。上传一个包含PHP序列的.jpg文件就可以触发该漏洞。
solution:Upgrade wsn forum to a higher version than 4.1.43,and avoid the version (,4.1.43]; Upgrade wsn gallery to a higher version than 4.1.30,and avoid the version (,4.1.30]; Upgrade wsn knowledge_base to a higher version than 4.1.36,and avoid the version (,4.1.36]; Upgrade wsn links to a higher version than 4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.0.7,4.0.8,4.0.9,4.0.10,4.0.11,4.0.12,4.0.13,4.0.14,4.0.15,4.0.16,4.0.17,4.0.18,4.0.19,4.0.20,4.0.21,4.0.22,4.0.23,4.0.24,4.0.25,4.0.26,4.0.27,4.0.28,4.0.29,4.0.30,4.0.31,4.0.32,4.0.33,4.0.34,4.0.35,4.0.36,4.0.37,4.0.38,4.0.39,4.0.40,4.0.41,4.1.0,4.1.1,4.1.2,4.1.3,4.1.4,4.1.5,4.1.6,4.1.7,4.1.8,4.1.9,4.1.10,4.1.11,4.1.12,4.1.13,4.1.14,4.1.15,4.1.16,4.1.17,4.1.18,4.1.19,4.1.20,4.1.21,4.1.22,4.1.23,4.1.24,4.1.25,4.1.26,4.1.27,4.1.28,4.1.29,4.1.30,4.1.31,4.1.32,4.1.33,4.1.34,4.1.35,4.1.36,4.1.37,4.1.38,4.1.39,4.1.40,4.1.41,4.1.42,4.1.43,4.1.44,and avoid the version 4.0.0,4.0.1,4.0.2,4.0.3,4.0.4,4.0.5,4.0.6,4.0.7,4.0.8,4.0.9,4.0.10,4.0.11,4.0.12,4.0.13,4.0.14,4.0.15,4.0.16,4.0.17,4.0.18,4.0.19,4.0.20,4.0.21,4.0.22,4.0.23,4.0.24,4.0.25,4.0.26,4.0.27,4.0.28,4.0.29,4.0.30,4.0.31,4.0.32,4.0.33,4.0.34,4.0.35,4.0.36,4.0.37,4.0.38,4.0.39,4.0.40,4.0.41,4.1.0,4.1.1,4.1.2,4.1.3,4.1.4,4.1.5,4.1.6,4.1.7,4.1.8,4.1.9,4.1.10,4.1.11,4.1.12,4.1.13,4.1.14,4.1.15,4.1.16,4.1.17,4.1.18,4.1.19,4.1.20,4.1.21,4.1.22,4.1.23,4.1.24,4.1.25,4.1.26,4.1.27,4.1.28,4.1.29,4.1.30,4.1.31,4.1.32,4.1.33,4.1.34,4.1.35,4.1.36,4.1.37,4.1.38,4.1.39,4.1.40,4.1.41,4.1.42,4.1.43,4.1.44