CVE-2018-20127

An issue was discovered in zzzphp cms 1.5.8

published December 13, 2018

CVSS
—
EPSS
1%
Percentile
71.9
In the wild
Unconfirmed
What it is

An issue was discovered in zzzphp cms 1.5.8. del_file in /admin/save.php allows remote attackers to delete arbitrary files via a mixed-case extension and an extra '.' character, because (for example) "php" is blocked but path=F:/1.phP. succeeds.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01388 · 71.9th percentile
Published
2018-12-13T08:00Z
EPSS history
Timeline
  • 13 DEC 08:00Z
    An issue was discovered in zzzphp cms 1.5.8
    cvelistv5