CVE-2018-20128

An issue was discovered in UsualToolCMS v8.0. cmsadmin\a_sqlback.php allows remote attackers to delete arbitrary files via a backname[] directory-traversal pathname followed by a crafted substring.

Score

CVSS 3.0 7.5 High

Status

Modified - cve@mitre.org

Published

2018-12-13

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Usualtoolcms (Usualtool)

References

• http://www.iwantacve.cn/index.php/archives/90/