| शीर्षक | https://www.ctcms.cn/ CTCMS Content Management System V2.1.2 Arbitrary File Deletion |
|---|
| विवरण | CTCMS contains an arbitrary file deletion vulnerability in the del() function located in ctcms\apps\controllers\admin\Tpl.php. The function improperly sanitizes user input by stripping .. and //, but this can be bypassed using combinations of ./ and ../. An attacker can craft payloads to traverse outside the intended directory and delete arbitrary files on the server, such as critical configuration files (config.php), sensitive data files, or even core system files like install.lock. Deleting these files can cause the website to crash, force a system reinstallation, expose sensitive information, or even lead to complete system compromise, making this a highly critical vulnerability. |
|---|
| स्रोत | ⚠️ https://github.com/xiaoyangsec/ctcms/blob/main/CTCMS_Arbitrary_File_Deletion_Vulnerability_Authenticated.md |
|---|
| उपयोगकर्ता | xiaoyang (UID 84496) |
|---|
| सबमिशन | 28/04/2025 07:25 AM (1 वर्ष पहले) |
|---|
| संयम | 10/05/2025 05:25 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 308292 [CTCMS Content Management System 2.1.2 File Tpl.php del Arquivo निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 20 |
|---|