CVE-2018-18713

Опубликовано: 29 окт. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.

Ссылки

http://jlkl.github.io/2018/10/25/CVE_02/
Broken Link
Third Party Advisory
http://str3am.me/2018/10/25/CVE_02/
Broken Link
Third Party Advisory
URL Repurposed
http://jlkl.github.io/2018/10/25/CVE_02/
Broken Link
Third Party Advisory
http://str3am.me/2018/10/25/CVE_02/
Broken Link
Third Party Advisory
URL Repurposed

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:phpyun:phpyun:4.6:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01054

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-6fm6-9mv4-9wgf