CVE-2018-20603

The CVE-2018-20603 entry concerns Lei Feng TV CMS (aka LFCMS) version 3.8.6, which is vulnerable to CSRF on the admin page admin.php?s=/Member/add.html. The root cause, as stated across connected records, is a cross-site request forgery vulnerability in the LFCMS 3.8.6 administrative interface, e...

CVE-2018-20604

CVE-2018-20604 affects Lei Feng TV CMS (LFCMS) 3.8.6. A Directory Traversal is possible by crafting URIs using ..* in Template/edit/path, e.g., admin.php?s=/Template/edit/path/web .... ..*..*1.txt.html, enabling reading of arbitrary files (demonstrated with 1.txt). The connected records confirm t...

CVE-2018-20602

CVE-2018-20602 affects Lei Feng TV CMS (LFCMS) 3.8.6. The vulnerability is an information disclosure via the URI /install.php?s=/1, resulting in full path disclosure. Multiple connected records corroborate this issue across sources (NVD entry, RH Red Hat advisory, CNVD/CNVD-2019-00991, PRION, etc...