CVE-2018-18713

The function downsqlaction in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=downsql&name=../ URI...