201 matches found
PT-2018-15149
Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.2 Description The issue concerns a SQL Injection vulnerability via the listorders function in AdminbaseController.class.php. This can be exploited with manager privilege through the listorderskey1 parameter in a "Link...
PT-2018-15147
Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.2 Description The issue is related to SQL Injection via the edit post function in NavController.class.php. It can be exploited with manager privilege using the parentid parameter in a "nav" action. Recommendations For...
PT-2018-15146
Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.2 Description The issue concerns a SQL Injection problem. It is exploitable through the ids parameter in a "commentadmin" action, specifically via the check and delete functions in CommentadminController.class.php, and...
ThinkCMF SQL Injection Vulnerability (CNVD-2019-07961)
ThinkCMF is a Chinese content management framework based on PHP+MYSQL. The check and delete functions in CommentadminController.class.php in ThinkCMF X2.2.2 are vulnerable to SQL injection, which can be exploited by users with administrator privileges via the ids parameter in the commentadmin...
CVE-2018-19898: Improper Neutralization of Special Elements used in an SQL Command
ThinkCMF X2.2.2 has SQL Injection via the method editpost in ArticleController.class.php and is exploitable by normal authenticated users via the postid1 parameter in an article editpost action...
ThinkCMF SQL Injection Vulnerability (CNVD-2019-07960)
ThinkCMF is a Chinese content management framework based on PHP+MYSQL. An SQL injection vulnerability exists in the editpost function in NavController.class.php in ThinkCMF X2.2.2, which can be exploited by users with administrator privileges to perform SQL injection attacks via the parentid...
PT-2018-15150
Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.2 Description The issue concerns a SQL Injection problem via the edit post method in ArticleController.class.php. It can be exploited by normal authenticated users through the postid1 parameter in an article edit post...
ThinkCMF SQL Injection Vulnerability (CNVD-2019-07958)
ThinkCMF is a Chinese content management framework based on PHP+MYSQL. The listorders function in AdminbaseController.class.php in ThinkCMF X2.2.2 has a SQL injection vulnerability that can be exploited by users with administrator privileges via the listorderskey1 parameter in the Link listorders...
ThinkCMF SQL Injection Vulnerability (CNVD-2019-07959)
ThinkCMF is a Chinese content management framework based on PHP+MYSQL. A SQL injection vulnerability exists in the delete function in SlideController.class.php in ThinkCMF X2.2.2, which can be exploited by users with administrator privileges via the ids parameter in the slide operation...
ThinkCMF Arbitrary File Deletion Vulnerability
ThinkCMF is a CMS Content Management System based on ThinkPHP. An arbitrary file deletion vulnerability exists in the 'doavatar' function in the \application\User\Controller\ProfileController.class.php file in ThinkCMF version X2.2.3. An attacker can delete arbitrary files with the help of the...
Arbitrary file deletion
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server...
CVE-2018-16141
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server...
CVE-2018-16141
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server...
CVE-2018-16141
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server...
CVE-2018-16141
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in do_avatar() within the ProfileController.class.php, exploitable via the imgurl parameter using a ..\ sequence. A member user can delete arbitrary files on a Windows server. Documented as CVE-2018-16141 in NVD/CNVD listings; no remedi...
CVE-2018-16141: Improper Limitation of a Pathname to a Restricted Directory
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server...
PT-2018-13420
Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.3 Description The issue allows for arbitrary file deletion. It is located in the do avatar function within the ProfileController.class.php file. The vulnerability can be exploited via the imgurl parameter by using a...
SQL Injection Vulnerability in ThinkCMF
ThinkCMF is a Chinese Content Management Framework CMF based on ThinkPHP+MYSQL. ThinkCMF has a SQL injection vulnerability , attackers can exploit the vulnerability to obtain sensitive database data...
