JTBC Cross-Site Request Forgery Vulnerability

JTBC PHP is a PHP-based open source content management system CMS. A cross-site request forgery vulnerability exists in the /console/account/manage.php?type=action&action=add URL in JTBC v3.0C. A remote attacker can exploit this vulnerability to add an administrator account...

CVE-2019-9662: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in JTBCPHP 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in "inc.php" can be deleted via a console/cache/manage.php?type=action&action=batch&batch=delete&ids=../ substring...

Remote Code Execution Vulnerability in JTBC (PHP) Content Management System

JTBC is an open source and free cross-platform web content management system solution. A remote code execution vulnerability exists in the JTBC PHP content management system. An attacker can exploit this vulnerability to execute arbitrary code...

CVE-2018-17429

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

CVE-2018-17429

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

Cross site request forgery (csrf)

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

CVE-2018-17429

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

CVE-2018-17429

CVE-2018-17429 refers to a CSRF vulnerability in JTBC v3.0(C) where requests to /console/account/manage.php?type=action&action=add can be forged to add an administrator account. A remote attacker can exploit this CSRF to elevate privileges by creating a new admin account. The reports in CNVD/othe...

CVE-2018-17429: Cross-Site Request Forgery (CSRF)

/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...

CVE-2019-8433

JTBCPHP 3.0.1.8 allows Arbitrary File Upload via the console//console/file/manage.php?type=list URI, as demonstrated by a .php file...

CVE-2019-8433

JTBCPHP 3.0.1.8 allows Arbitrary File Upload via the console//console/file/manage.php?type=list URI, as demonstrated by a .php file...

CVE-2019-8433: Unrestricted Upload of File with Dangerous Type

JTBCPHP 3.0.1.8 allows Arbitrary File Upload via the console//console/file/manage.php?type=list URI, as demonstrated by a .php file...

CVE-2019-8433

JTBCPHP 3.0.1.8 allows Arbitrary File Upload via the console//console/file/manage.php?type=list URI, as demonstrated by a .php file...

CVE-2019-8433

CVE-2019-8433 affects JTBC(PHP) 3.0.1.8, allowing arbitrary file upload via the console/#/console/file/manage.php?type=list URI, demonstrated by uploading a .php file. This indicates a flaw in file handling/validation on that endpoint. The available connected documents confirm the vulnerability d...

Code injection

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

CVE-2018-19547

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

Design/Logic Flaw

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

CVE-2018-19547

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...