Show filters
4 Total Results
Displaying 1-4 of 4
Sort by:
Attacker Value
Unknown

CVE-2018-20571

Disclosure Date: December 28, 2018 (last updated November 27, 2024)
DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\Config\config.ini.php to read the global configuration file.
0
0
Attacker Value
Unknown

CVE-2018-16238

Disclosure Date: August 30, 2018 (last updated November 27, 2024)
An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example, this can update the Web/Tpl/default/head.html file.
0
0
Attacker Value
Unknown

CVE-2018-16237

Disclosure Date: August 30, 2018 (last updated November 27, 2024)
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI.
0
0
Attacker Value
Unknown

CVE-2018-16239

Disclosure Date: August 30, 2018 (last updated November 27, 2024)
An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses.
0
0