Unscored CVE-2018-13025 EUVD-2018-4975GHSA-c576-9x3v-qh9c

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=ad…

Published Jun 29, 2018 · Updated Sep 17, 2024 · Assigned by mitre

Description

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter.

References

https://github.com/zhaoheng521/yxcms/blob/master/Any%20file%20deletion