未評価
jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitr...
CVE-2020-37117
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
jizhiCMS 1.6.7 contains a file download vulnerability in the admin plugins update endpoint that allows authenticated administrators to download arbitrary files. Attackers can exploit the vulnerability by sending crafted POST requests with malicious filepath and download_url parameters to trigger unauthorized file downloads.
参照URL
- advisory vulncheck.com
- report exploit-db.com
- web jizhicms.cn