CVE-2018-18487

In \lib\admin\action\dataaction.class.php in Gxlcms v2.0, the database backup filename generation uses mt_rand() unsafely, resulting in predictable database backup file locations.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-10-18

Last modified

2024-09-17

Weaknesses

CWE-200

Affected products

• Gxlcms (Gxlcms)

References

• http://sunu11.com/2018/10/18/glxcms/