CVE-2018-17837

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substring...

CVE-2018-17836

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...

CVE-2018-17836

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...

Arbitrary file deletion

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substring...

Code injection

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file read operations are possible via a /console//console/file/manage.php?type=list&path=c:/ substring...

Design/Logic Flaw

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...

CVE-2018-17837

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substring...

CVE-2018-17838

An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file read operations are possible via a /console//console/file/manage.php?type=list&path=c:/ substring...

CVE-2018-17836

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...

CVE-2018-17836

JTBC(PHP) 3.0.1.6 is affected by CVE-2018-17836. A remote attacker can execute arbitrary PHP code by exploiting a file upload via /console/file/manage.php?type=action&action=addfile&path=..%2F in combination with a multipart/form-data PHP payload. The vulnerability stems from a path-traversal/uns...

CVE-2018-17838

CVE-2018-17838 affects JTBC(PHP) 3.0.1.6. The vulnerable component allows arbitrary file read via the web path /console/#/console/file/manage.php?type=list&path=c:/, enabling reading of arbitrary server files. All sources consistently describe this vulnerability as an arbitrary file read in JTBC(...

CVE-2018-17837

The CVE-2018-17837 entry concerns JTBC(PHP) 3.0.1.6, where an attacker could trigger arbitrary file deletion through /console/file/manage.php?type=action&action=delete&path=c%3A%2F. The issue is documented across multiple sources (NVD/CNVD/CVELIST/etc.) with the same exposure: the vulnerable comp...

Arbitrary file upload vulnerability in JTBC Web Content Management System (PHP) manage.inc.php page

JTBC website content management system PHP is a set of existing modules can be expanded and cloning of the core of the website system, using UTF-8 coding, to take the language/code/program two separate technical modes. An arbitrary file upload vulnerability exists in the JTBC Web Content Manageme...

JTBCcms 'uu_upload_file' function has SQL injection vulnerability

JTBC is an open source and free cross-platform web content management system solution. JTBCcms 'uuuploadfile' function SQL injection vulnerability. The vulnerability is caused by the failure to effectively filter the parameters used in the user upload file , an attacker can exploit the...