CVE-2021-37144

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization.

CVSS v3.1

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS

1.28% chance of exploitation in the next 30 days, 68th percentile

Published

2021-07-29

Updated

2024-08-04

Proof-of-concept exploits (1)

• cskaza/cszcms/issues/32

References

• CVE Record
• NVD entry

Related

• CVE-2019-7566
• CVE-2021-26776
• CVE-2021-3224
• CVE-2021-43701
• CVE-2021-3710
• CVE-2021-3715