CVE-2022-36261

Name of the Vulnerable Software and Affected Versions taocms version 3.0.2

Description An arbitrary file deletion issue was found, allowing an attacker to delete files on the server by requesting a specific URL. The issue can be exploited through the admin.php endpoint with parameters such as action, ctrl, and path. For example, an attacker could use the path parameter to specify a file location like /../../../test.txt for deletion.

Recommendations For taocms version 3.0.2, consider restricting access to the admin.php endpoint or disabling the file deletion functionality until a fix is available. Avoid using the path parameter in the affected endpoint to minimize the risk of exploitation.