CVE-2020-19890

DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $GET'file' is filename,and as there is no filter function for security, you can read any file's content...

CVE-2020-19890

DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $GET'file' is filename,and as there is no filter function for security, you can read any file's content...

Design/Logic Flaw

DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $POST'updatefile' is filename and $POST'tinymcecontent' is file content, there is no filter function for security. A remote authenticated admin user can exploit this vulnerability to get a webshell...

CVE-2020-19891

CVE-2020-19891 affects DBHcms v1.2.0. A vulnerability in file dbhcms/mod/mod.editor.php allows arbitrary file write via POSTed updatefile (filename) and tinymce_content (file content) because there is no security filtering. A remote authenticated admin user can exploit this to obtain a webshell. ...

CVE-2020-19891

DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $POST'updatefile' is filename and $POST'tinymcecontent' is file content, there is no filter function for security. A remote authenticated admin user can exploit this vulnerability to get a webshell...

CVE-2020-19890

CVE-2020-19890 affects DBHcms v1.2.0. An arbitrary file read flaw exists in the file path handling for the editor module (dbhcms/mod/mod.editor.php) where $_GET['file'] is not filtered, allowing reading of arbitrary files. This is a server-side vulnerability impacting confidentiality; the provide...

CVE-2020-19890

DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $GET'file' is filename,and as there is no filter function for security, you can read any file's content...

PT-2020-15217

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0 Description The issue allows a remote authenticated admin user to exploit an Arbitrary file write vulnerability. This is due to the lack of a filter function for security in the mod.editor.php file. Specifically, the $...

CVE-2020-19891: Out-of-bounds Write

DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcms\mod\mod.editor.php $POST'updatefile' is filename and $POST'tinymcecontent' is file content, there is no filter function for security. A remote authenticated admin user can exploit this vulnerability to get a webshell...

PT-2020-15216

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0 Description The issue allows for arbitrary file read due to a lack of security filtering in the mod.editor.php module. Specifically, the $ GET'file' variable is used to specify the filename without proper validation,...

CVE-2020-19890: Authorization Bypass Through User-Controlled Key

DBHcms v1.2.0 has an Arbitrary file read vulnerability in dbhcms\mod\mod.editor.php $GET'file' is filename,and as there is no filter function for security, you can read any file's content...