CVE-2019-8291

HIGH

Online Store System v1.0 - Unauthenticated Path Traversal via delete_file.php

Title source: llm
STIX 2.1

Description

Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory x_refsource_misc
http://www.vapidlabs.com/advisory.php?v=210
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2019/10/02/1

Scores

CVSS v3 7.5
EPSS 0.0141
EPSS Percentile 69.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-22
Status published
Products (1)
online_store_system_project/online_store_system 1.0
Published Oct 01, 2019
Tracked Since Feb 18, 2026