PT-2018-13573

CVE-2018-16446

·

Publicado

2018-09-04

·

Atualizado

2018-10-25

Descrição por

CVSS 3.1
7.5
Alta
MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions SeaCMS versions through 6.61
Description An issue in SeaCMS allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter in the 'adm1n/admin database.php' endpoint. This can lead to the product being reinstalled by deleting 'install lock.txt'.
Recommendations For SeaCMS versions through 6.61, consider restricting access to the 'adm1n/admin database.php' endpoint to prevent exploitation, and avoid using the bakfiles parameter until the issue is resolved.
Explorabilidade
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Identificadores relacionados
CVE-2018-16446
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com