CVE-2019-7160: Path Traversal

Published Jan 29, 2019

Updated

idreamsoft iCMS 7.0.13 allows admincp.php?app=files ../ Directory Traversal via the udir parameter to files.admincp.php, resulting in execution of arbitrary PHP code from a ZIP file via the admincp.php?app=apps zipfile parameter to apps.admincp.php.

Affected Software

1 affected component

idreamsoft iCMS=7.0.13

Remediation

Patch Available

https://github.com/idreamsoft/iCMS/issues/50

Event History

Jan 29, 2019

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:29 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2019-7160?

CVE-2019-7160 is a vulnerability in idreamsoft iCMS 7.0.13 that allows directory traversal and execution of arbitrary PHP code.

How severe is CVE-2019-7160?

CVE-2019-7160 has a severity rating of 9.8 (Critical).

How does CVE-2019-7160 affect idreamsoft iCMS?

CVE-2019-7160 affects idreamsoft iCMS version 7.0.13.

What is the CWE classification of CVE-2019-7160?

CVE-2019-7160 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

Is there a fix for CVE-2019-7160?

A fix is not available at the moment. It is recommended to update to a version of idreamsoft iCMS that is not affected by this vulnerability when it becomes available.