[CVE-2018-12053] Schools Alert Management Script - Arbitrary File Deletion #6
Comments
unh3x
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
unh3x
changed the title
=================
Schools Alert Management Script - Arbitrary File Deletion
Date: 07.06.2018
Vendor Homepage: https://www.phpscriptsmall.com/
Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
Category: Web Application
Exploit Author: xiaotian.wang From DBAppSecurity
CVE: CVE-2018-12053
=================
Vulnerable cgi:
delete_img.php
=================
Proof of Concept:
notice: There is a risk of file deletion，you'd better test it combined with the furthur file upload vulnerability.
Attackers can delete any file through parameter 'img' with '../' .
The text was updated successfully, but these errors were encountered: