CVE-2019-7235

The CVE-2019-7235 entry concerns idreamsoft iCMS 7.0.13. A directory traversal flaw exists in admincp.php?app=apps&do=save that can be triggered through _app=/../ to designate an arbitrary directory; this path can then be deleted via an admincp.php?app=apps&do=uninstall request. The connected doc...

CVE-2019-7236

An issue was discovered in idreamsoft iCMS 7.0.13. editor/editor.admincp.php allows admincp.php?app=editor&do=fileManager dir=../ Directory Traversal...

idreamsoft iCMS Directory Traversal Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in idreamsoft iCMS version 7.0.13. The vulnerability can be exploited to execute arbitrary PHP code in a ZIP file with the help of 'udir' and 'zipfile' parameters...

CVE-2019-7160

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php...

idreamsoft iCMS SQL Injection Vulnerability (CNVD-2019-12126)

iCMS is an efficient and simple content management system built with PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.13, which can be exploited by remote attackers to execute SQL commands with the help of the 'dataid' parameter...

Sql injection

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...

CVE-2019-6259

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...

CVE-2019-6259

CVE-2019-6259 affects idreamsoft iCMS v7.0.13. The issue is a SQL injection via the app/article/article.admincp.php _data_id parameter, indicating improper input handling in that parameter is the root cause. The vulnerability can compromise data confidentiality, integrity, and availability as des...

idreamsoft iCMS Path Traversal Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A path traversal vulnerability exists in admincp.php?app=config in idreamsoft iCMS version 7.0.11, which can be exploited by remote attackers to execute arbitrary PHP code in a ZIP file...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-19090)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in the admincp.php file in version 7.0.11 of idreamsoft iCMS. The vulnerability stems from the detection of CSRFTOKEN when it does not exist, and the program...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-10136)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in idreamsoft iCMS version 7.0.10, which can be exploited by remote attackers to add an administrator account with the help of admincp.php?app=user&do=save...

CVE-2018-16365

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...

CVE-2018-16366

CVE-2018-16366 affects idreamsoft iCMS v7.0.10. The connected documents confirm a Cross-Site Request Forgery (CSRF) in admincp.php?app=user&do=save, enabling an attacker to perform privileged actions. One CNVD record notes an exploit path where a remote attacker could add an administrator account...

CVE-2018-16365

CVE-2018-16365 : In idreamsoft iCMS v7.0.10, the admincp.php?app=group&do=save endpoint is vulnerable to Cross-Site Request Forgery (CSRF). The CNVD entry notes this CSRF can be exploited to add an administrator account, indicating a real impact vector affecting CMS login/privilege management. Af...

CVE-2018-16366

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=user&do=save allows CSRF...

Directory traversal

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

CVE-2018-16314

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

CVE-2018-16320

CVE-2018-16320 affects idreamsoft iCMS 7.0.11. A directory traversal flaw in admincp.php?app=config enables arbitrary PHP code execution from a ZIP file. Root cause: path traversal in the configuration admin endpoint. Impact: arbitrary code execution; exploitation status is not provided in the do...

CVE-2018-16314

The CVE-2018-16314 issue affects idreamsoft iCMS 7.0.11, specifically the admincp.php CSRF verification. If CSRF_TOKEN is absent, the system validates only the Referer header, which can be bypassed via a substring in admincp.php within that header. This describes a CSRF protection bypass vulnerab...

CVE-2018-15895

An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spidertools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an...