CVE-2018-19329

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603

Description The issue allows remote authenticated administrators to delete arbitrary files by modifying a base64-encoded pathname in an "m=admin&c=media&a=delfilehandle&id=" call. This is related to the delete button in the "m=admin&c=media&a=restorefile" functionality.

Recommendations For GreenCMS version 2.3.0603, consider restricting access to the "m=admin&c=media&a=delfilehandle&id=" endpoint to prevent arbitrary file deletion until a fix is available. As a temporary workaround, limit the use of the delete button in the "m=admin&c=media&a=restorefile" functionality to minimize the risk of exploitation.