CVE-2018-18713

The function down_sql_action() in /admin/model/database.class.php in PHPYun 4.6 allows remote attackers to read arbitrary files via directory traversal in an m=database&c=down_sql&name=../ URI.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-10-29

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Phpyun (Phpyun)

References

• http://jlkl.github.io/2018/10/25/CVE_02/
• http://str3am.me/2018/10/25/CVE_02/