CVE-2017-11325
HighSummary
An issue was discovered in Tilde CMS version 1.0.1 that allows arbitrary files to be read via a file=../ attack on actionphp/download.File.php.
Risk Assessment
An attacker could gain access to sensitive data on the server, potentially leading to serious security breaches.
Recommendation
It is recommended to update Tilde CMS to the latest version and implement appropriate security measures to block such attacks.
Other vulnerabilities in Tilde CMS 1.0.1
See all- CVE-2017-11326High
An issue was discovered in Tilde CMS version 1.0.1 that allows bypassing the implemented restrictions on arbitrary file upload via filename manipulation with .php extension.
- CVE-2017-11324Critical
An issue was discovered in Tilde CMS version 1.0.1 due to missing escaping of the backtick character, leading to SQL Injection vulnerability in the SELECT query in class.SystemAction.php.
Original NVD description (English source)
An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php.