PT-2018-13573 · Seacms · Seacms

Michaelwayneliu · Publicado 2018-09-04 · Atualizado 2018-10-25 · CVE-2018-16446

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SeaCMS versions through 6.61

Description An issue in SeaCMS allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter in the 'adm1n/admin database.php' endpoint. This can lead to the product being reinstalled by deleting 'install lock.txt'.

Recommendations For SeaCMS versions through 6.61, consider restricting access to the 'adm1n/admin database.php' endpoint to prevent exploitation, and avoid using the bakfiles parameter until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-16446

Produtos afetados

Seacms

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-16446 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16446 · Aviso do Fabricante
• https://github.com/MichaelWayneLIU/seacms/blob/master/seacms5.md · Nota