CVE-2018-17125

CScms 4.1 allows arbitrary directory deletion via a dir=..\ substring to plugins\sys\admin\Plugins.php...

CVE-2018-17125

CVE-2018-17125 affects CScms 4.1. The vulnerability is an arbitrary directory deletion flaw in the plugins/sys/admin/Plugins.php handler, triggered by a dir=..\ substring that allows deleting arbitrary directories. This is due to insufficient input validation of the dir parameter, enabling path t...

CVE-2018-17126

CVE-2018-17126 affects CScms 4.1. The vulnerability is a remote code execution through a crafted input in Web Name to upload\plugins\sys\Install.php, leveraging 1');eval($_POST[cmd]);# in the Install.php file. This indicates an unauthenticated remote command execution path via user-supplied POST ...

CVE-2018-17126

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

CScms Remote Code Execution Vulnerability

CScms is a content management system CMS developed on a CI framework. A security vulnerability exists in CScms version 4.1. A remote attacker can exploit the vulnerability to execute code...

CScms Arbitrary Directory Deletion Vulnerability

CScms is a content management system CMS developed on a CI framework. An arbitrary directory deletion vulnerability exists in CScms version 4.1. An attacker can delete arbitrary directories by sending a dir=... to the plugins\sys\admin\Plugins.php page. \\ sub-string to the...

PT-2018-13906

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue allows for arbitrary directory deletion. This can be achieved by using a specific substring dir=.. in requests to the "pluginssysadminPlugins.php" endpoint. Recommendations For CScms version 4.1, conside...

PT-2018-13907

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue allows remote code execution. This can be demonstrated by using the input 1';eval$ POSTcmd; in the Web Name field to upload a file to pluginssysInstall.php. Recommendations For CScms version 4.1, as a...

CVE-2018-17126: Improper Control of Generation of Code

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

CVE-2018-17125: Improper Limitation of a Pathname to a Restricted Directory

CScms 4.1 allows arbitrary directory deletion via a dir=..\ substring to plugins\sys\admin\Plugins.php...

CScms Cross-Site Scripting Vulnerability

CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the \upload\plugins\sys\Install.php file in CScms version 4.1. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML by using the site name...

Cross site request forgery (csrf)

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

Default credentials

CScms 4.1 allows arbitrary file upload by for example adding the php extension to the default filetype list gif, jpg, png, and then providing a .php pathname within fileurl JSON data...

Cross site scripting

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name...

CVE-2018-16732

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

CVE-2018-16730

CVE-2018-16730 : In CScms 4.1, a cross-site scripting (XSS) vulnerability exists in the file path "\upload\plugins\sys\Install.php" triggered via the site name. The issue is documented across multiple sources (e.g., NVD/CNVD entries) as a CMS-originated XSS in that specific component. The connect...

CVE-2018-16732

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

CVE-2018-16731

CVE-2018-16731 affects CScms 4.1 and is described as an arbitrary file upload vulnerability: an attacker can add the php extension to the allowed filetype list and supply a .php pathname inside the fileurl JSON data to obtain uploaded PHP code. The connected records confirm the issue and provide ...