CVE-2018-18485: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock...

PT-2018-14485

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter in the "admin.php?mod=db&act=del" API endpoint. This can be leveraged to...