PT-2015-5364

Name of the Vulnerable Software and Affected Versions u5CMS versions prior to 3.9.4 Description The issue allows remote attackers to write to arbitrary files. This can be achieved by providing a 1 .. dot dot or 2 full pathname in the f parameter of the /u5admin/deletefile.php API endpoint...