CVE-2019-7236

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal...

CVE-2019-7237

An issue was discovered in idreamsoft iCMS 7.0.13 on Windows. editor/editor.admincp.php allows admincp.php?app=files&do=browse ..\ Directory Traversal...

CVE-2019-7237

CVE-2019-7237 affects idreamsoft iCMS 7.0.13 on Windows. The vulnerability is a Directory Traversal in editor/editor.admincp.php, exploitable via a crafted path (admincp.php?app=files&do=browse ..) to view files outside the intended directory. CNVD/CNVD-2019-12124 and CNVD entries describe the sa...

CVE-2019-7236

The CVE-2019-7236 issue affects idreamsoft iCMS 7.0.13 . The vulnerability is a directory traversal in the file editor/editor.admincp.php, exploitable via a payload that manipulates dir=../ to view files outside the intended directory. Core description in CNVD-2019-12125 confirms the vulnerabilit...

CVE-2019-7234

The CVE-2019-7234 entry affects idreamsoft iCMS 7.0.13. The vulnerability stems from an error in admincp.php?app=apps&do=save (via _app=/../ in apps.admincp.php) that enables directory traversal, permitting creation of a ZIP archive containing contents of an arbitrary directory, which can then be...

idreamsoft iCMS Directory Traversal Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in idreamsoft iCMS version 7.0.13. The vulnerability can be exploited to execute arbitrary PHP code in a ZIP file with the help of 'udir' and 'zipfile' parameters...

CVE-2019-7160

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...

CVE-2019-7160

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...

Directory traversal

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...

CVE-2019-7160

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...

CVE-2019-7160

CVE-2019-7160 affects idreamsoft iCMS 7.0.13. The vulnerability is a Directory Traversal in which an attacker can reach admincp.php?app=files with the udir parameter and files.admincp.php, enabling arbitrary PHP code execution from a ZIP file passed via admincp.php?app=apps with the zipfile param...

idreamsoft iCMS SQL Injection Vulnerability (CNVD-2019-12126)

iCMS is an efficient and simple content management system built with PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.13, which can be exploited by remote attackers to execute SQL commands with the help of the 'dataid' parameter...

CVE-2019-6259

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...

CVE-2019-6259

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...

CVE-2019-6259

CVE-2019-6259 affects idreamsoft iCMS v7.0.13. The issue is a SQL injection via the app/article/article.admincp.php _data_id parameter, indicating improper input handling in that parameter is the root cause. The vulnerability can compromise data confidentiality, integrity, and availability as des...

CVE-2018-18702

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=importrule because the upfile content is base64 decoded, deserialized, and used for database insertion...

Sql injection

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=importrule because the upfile content is base64 decoded, deserialized, and used for database insertion...

CVE-2018-18702

The CVE applies to iCMS v7.0.11, where spider.admincp.php is vulnerable to SQL injection via admincp.php?app=spider&do=import_rule. The vulnerability arises because upfile content is base64 decoded, deserialized, and used to form a database insertion, allowing for injected SQL. CVSS shows high se...

CVE-2018-18702

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=importrule because the upfile content is base64 decoded, deserialized, and used for database insertion...

idreamsoft iCMS Path Traversal Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A path traversal vulnerability exists in admincp.php?app=config in idreamsoft iCMS version 7.0.11, which can be exploited by remote attackers to execute arbitrary PHP code in a ZIP file...