| शीर्षक | DESHANG DSShop <=3.1.0 Arbitrary File Deletion |
|---|
| विवरण | The DSShop System, version 3.1.0 and earlier, has an Arbitrary File Deletion vulnerability in the file application/home/controller/MemberAuth.php. The flaw allows an attacker to manipulate a user's property, specifically the member_areainfo, to delete any file on the server. By creating a new user, setting its property to the path of an arbitrary file, and using the image_upload function to create an idcard_image folder, an attacker can subsequently send a request to image_drop to delete the targeted file. This vulnerability could be exploited to delete crucial files such as the installation lock, allowing the attacker to reinstall the website and gain control over the target system. |
|---|
| स्रोत | ⚠️ https://note.zhaoj.in/share/ZpRTCLblKd7N |
|---|
| उपयोगकर्ता | glzjin (UID 59815) |
|---|
| सबमिशन | 09/01/2024 11:37 AM (3 साल पहले) |
|---|
| संयम | 11/01/2024 11:23 AM (2 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 250437 [DeShang DSShop तक 2.1.5 MemberAuth.php member_info] |
|---|
| अंक | 20 |
|---|