CVE-2018-19748
HIGHSDCMS 1.6 - Path Traversal via Base64-Encoded Root Parameter
Title source: llmDescription
app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal. The value of the root parameter must be base64 encoded (note that base64 encoding, instead of URL encoding, is very rare in a directory traversal attack vector).
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://blog.whiterabbitxyj.com/cve/SDCMS_1.6_directory_traversal.doc
Exploit, Third Party Advisory x_refsource_misc
https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/SDCMS_1.6_directory_traversal.doc
Scores
CVSS v3
7.5
EPSS
0.0202
EPSS Percentile
78.6%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-22
Status
published
Products (1)
sdcms/sdcms
1.6
Published
Nov 29, 2018
Tracked Since
Feb 18, 2026