medium4.9
CVE-2018-20420
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creat…
Impact
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Weberp | Weberp | Version 4.15 |