PT-2018-13573 · Seacms · Seacms

Michaelwayneliu · Published 2018-09-04 · Updated 2018-10-25 · CVE-2018-16446

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SeaCMS versions through 6.61

Description An issue in SeaCMS allows remote attackers to delete arbitrary files via directory traversal sequences in the bakfiles parameter in the 'adm1n/admin database.php' endpoint. This can lead to the product being reinstalled by deleting 'install lock.txt'.

Recommendations For SeaCMS versions through 6.61, consider restricting access to the 'adm1n/admin database.php' endpoint to prevent exploitation, and avoid using the bakfiles parameter until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-16446

Affected Products

Seacms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-16446 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16446 · Vendor Advisory
• https://github.com/MichaelWayneLIU/seacms/blob/master/seacms5.md · Note