| 제목 | MuYuCMS 2.7 Directory Traversal |
|---|
| 설명 | A critical directory traversal vulnerability exists in MuYuCMS version 2.7 within the file management component of the accessory management module. The vulnerability is located in the filesdel method of Accessory.php (application/admin/controller/Accessory.php), where the 'filedelur' parameter is used to construct file deletion paths without proper sanitization. The application directly concatenates user-supplied input with base directory paths and passes it to file deletion functions, allowing authenticated attackers to inject directory traversal sequences (e.g., "../") and delete arbitrary files outside the intended upload directory. Successful exploitation can lead to complete system compromise through denial of service by removing critical system files or privilege escalation by deleting security-related configuration files. |
|---|
| 원천 | ⚠️ https://gist.github.com/b1uel0n3/bc45f5318cf8c60667ee5d39f5e2885e |
|---|
| 사용자 | b1uel0n3 (UID 93016) |
|---|
| 제출 | 2025. 11. 27. AM 05:32 (10 개월 ago) |
|---|
| 모더레이션 | 2025. 12. 16. PM 02:18 (19 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 221804 [MuYuCMS 2.2 filesdel.html filedelur 디렉토리 순회] |
|---|
| 포인트들 | 0 |
|---|