Design/Logic Flaw

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt modrewrite-less URL routing."...

PT-2012-1337

Name of the Vulnerable Software and Affected Versions SilverStripe versions 2.3.x through 2.3.6 Description The issue concerns the deleteinstallfiles function in control/ContentController.php, which does not require ADMIN permissions. This allows remote attackers to delete index.php, disrupting m...