CVE-2018-18485

An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS

1.84% chance of exploitation in the next 30 days, 77th percentile

Published

2018-10-18

Updated

2024-09-16

Proof-of-concept exploits (1)

• https://gitee.com/koyshe/phpshe/issues/INOG4

References

• CVE Record
• NVD entry

Related

• CVE-2018-18484
• CVE-2018-18489
• CVE-2018-18483
• CVE-2018-18500
• CVE-2018-18481
• CVE-2018-18520