CVE-2019-8291

Description

Online Store System v1.0 delete_file.php doesn't check to see if a user has administrative rights nor does it check for path traversal.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• http://www.vapidlabs.com/advisory.php?v=210 ↗
• https://www.abcprintf.com/view_download.php?id=17 ↗
• http://www.openwall.com/lists/oss-security/2019/10/02/1 ↗