CVE-2024-11992

Description

Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended restrictions and download any file if it has the appropriate permissions outside of documentroot configured on the server via the aDirFiles%5B0%5D parameter in the admin.php page. This vulnerability allows an attacker to delete files stored on the server due to a lack of proper verification of user-supplied input.

Reserved 2024-11-29 | Published 2024-11-29 | Updated 2024-11-29 | Assigner INCIBE

Problem types

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

6.7
affected

Credits

Rafael Pedrero finder

References

www.incibe.es/...aviso/path-traversal-vulnerability-quickcms

cve.org (CVE-2024-11992)

nvd.nist.gov (CVE-2024-11992)

Download JSON