| शीर्षक | SeaCMS 13.3 Directory Traversal / Arbitrary File Deletion |
|---|
| विवरण | SeaCMS 13.3 contains a directory traversal vulnerability in the backend template management module.
An authenticated attacker with access to the admin panel can exploit the 'path' parameter in
`/30h9r/admin_template.php` to traverse outside the intended template directory.
For example:
GET /30h9r/admin_template.php?path=../templets/default/../../ HTTP/1.1
Host: [target]
Successful exploitation allows an attacker to access the website root directory and perform
arbitrary file operations. Although PHP files cannot be directly read via the browser,
the vulnerability enables deletion of arbitrary files within the web root.
This can lead to denial of service (DoS), configuration loss, or disruption of critical functionality. |
|---|
| स्रोत | ⚠️ https://github.com/coolcj-stack/seacms-v13.3-Arbitrary-file-deletion-vulnerability/blob/main/README.md |
|---|
| उपयोगकर्ता | BlackSpdier (UID 89912) |
|---|
| सबमिशन | 07/09/2025 06:10 PM (1 वर्ष पहले) |
|---|
| संयम | 17/09/2025 09:10 AM (10 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 271373 [SeaCMS 12.9 admin_template.php दूरस्थ कोड निष्पादन] |
|---|
| अंक | 0 |
|---|