CVE-2018-20127

HIGH

zzzphp 1.5.8 - Arbitrary File Deletion via Mixed-Case Extension Bypass

Title source: llm
STIX 2.1

Description

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
http://www.iwantacve.cn/index.php/archives/89/

Scores

CVSS v3 7.5
EPSS 0.0139
EPSS Percentile 69.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20
Status published
Products (1)
zzzcms/zzzphp 1.5.8
Published Dec 13, 2018
Tracked Since Feb 18, 2026