ThinkCMF Arbitrary File Deletion Vulnerability

ThinkCMF is a CMS Content Management System based on ThinkPHP. An arbitrary file deletion vulnerability exists in the 'doavatar' function in the \application\User\Controller\ProfileController.class.php file in ThinkCMF version X2.2.3. An attacker can delete arbitrary files with the help of the...

PT-2018-13420

Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.3 Description The issue allows for arbitrary file deletion. It is located in the do avatar function within the ProfileController.class.php file. The vulnerability can be exploited via the imgurl parameter by using a...