CVE-2017-8868
HighSummary
The acp/core/files.browser.php in flatCore 1.4.7 has a vulnerability that allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.
Risk Assessment
The organization may be exposed to unauthorized file deletion, potentially leading to data loss or disruption of system functionality. Potential attacks could be executed through malicious scripts exploiting CSRF.
Recommendation
It is recommended to implement appropriate CSRF protections and input parameter validation to prevent directory traversal attacks.
Other vulnerabilities in flatCore 1.4.7
See all- CVE-2017-7879High
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
- CVE-2017-7877High
CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
- CVE-2017-7878Critical
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
Original NVD description (English source)
acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.