CVE-2018-18713

The function downsqlaction in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=downsql&name=../ URI...

PT-2018-14591 · Phpyun · Phpyun

Name of the Vulnerable Software and Affected Versions: PHPYun version 4.6 Description: The issue allows remote attackers to read arbitrary files via directory traversal. This is possible through the function down sql action in the file /admin/model/database.class.php. The vulnerability can be...