vendor:
PunBB
by:
Dante90, WaRWolFz Crew
7,5
CVSS
HIGH
Arbitrary File Deletion
22
CWE
Product Name: PunBB
Affected Version From: 1.3.5
Affected Version To: 1.3.5
Patch Exists: NO
Related CWE: N/A
CPE: a:punbb:punbb:1.3.5
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
PunBB Automatic Image Upload <= v1.3.5 Delete Arbitrary File Vulnerability
This vulnerability allows an attacker to delete arbitrary files from the server if the '$Allow_Delete[] = "[USERGROUP]";' is not commented in "uploadimg_config.php" [FIND LINE: 75]. An attacker can use a malicious script to login to the server and delete any file from the server.
Mitigation:
Comment the '$Allow_Delete[] = "[USERGROUP]";' in "uploadimg_config.php" [FIND LINE: 75] to prevent arbitrary file deletion.