CVE-2018-9331

An issue was discovered in zzcms 8.2. user/adv.php allows remote attackers to delete arbitrary files via directory traversal sequences in the oldimg parameter. This can be leveraged for database access by deleting install.lock.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2018-04-07

Last modified

2024-08-05

Weaknesses

CWE-22

Affected products

• Zzcms (Zzcms)

References

• https://github.com/cherryla/zzcms/blob/master/adv.php.md