CVE-2018-16141: Improper Limitation of a Pathname to a Restricted Directory

ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server...

PT-2018-13420

Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.3 Description The issue allows for arbitrary file deletion. It is located in the do avatar function within the ProfileController.class.php file. The vulnerability can be exploited via the imgurl parameter by using a...

SQL Injection Vulnerability in ThinkCMF

ThinkCMF is a Chinese Content Management Framework CMF based on ThinkPHP+MYSQL. ThinkCMF has a SQL injection vulnerability , attackers can exploit the vulnerability to obtain sensitive database data...

thinkcmf background getshell

No description provided by source...

thinkcmf \application\User\Controller\ProfileController.class.php arbitrary file delete vulnerability

No description provided by source...

ThinkCMF 信息泄露漏洞

No description provided by source...