CVE-2018-18626

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because del_action() in admin/model/database.class.php mishandles this parameter.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-10-23

Last modified

2024-09-16

Affected products

• Phpyun (Phpyun)

References

• http://str3am.me/2018/10/23/CVE_01/#more