NetSight
IP …
low3.5

CVE-2012-6064

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrat…

Impact

Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter. NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.

Affected products

VendorProductAffected versions
CmsmadesimpleCms Made Simple
through 1.11.2
Versions 0.1, 0.2, 0.2.1, 0.3, 0.3.1

Weakness classification

CWE-22

References