CVE-2018-16774

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0

Description The issue allows for arbitrary file deletion. This can be achieved by manipulating the file parameter in the /admin/index.php/language/ajax endpoint with a ../ sequence and setting the action parameter to delete.

Recommendations For HongCMS version 3.0.0, avoid using the delete action in the /admin/index.php/language/ajax endpoint until a fix is available. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation.