file-management-system-php vulnerabilities

In oretnom23 file-management-system-php (up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4), the delete_folder function in ajax.php (AJAX Handler component) lacks authentication when the ID argument is manipulated. The vulnerability can be exploited remotely and a public exploit is already available.

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The readfile function in download.php is affected by manipulation of the ID argument leading to SQL injection; the attack may be performed remotely and a public exploit exists.

A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the Login function in admin_class.php. Manipulation of the username/password argument leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available and might be used. The product follows a rolling release approach, so version details are not provided. The project was informed but has not responded yet.