bettershop/LaikeTui
GitHub
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 9.8 CRITICAL | 7.5 HIGH | ||
Laiketui 3.5.0 is affected by an arbitrary file upload vulnerability that can allow an attacker to execute arbitrary code. | |||
| 7.2 HIGH | 6.5 MEDIUM | ||
SQL injection exists in LaiKetui v3.5.0 the background administrator list. | |||
| 7.5 HIGH | 5 MEDIUM | ||
LaiKetui v3.5.0 has SQL injection in the background through the menu management function, and sensitive data can be obtained. | |||
| 8.8 HIGH | 6.5 MEDIUM | ||
LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname. | |||
| 8.1 HIGH | 5.5 MEDIUM | ||
LaikeTui 3.5.0 allows remote authenticated users to delete arbitrary files, as demonstrated by deleting install.lock in order to reinstall the product in an attacker-controlled manner. This deletion is possible via directory traversal in the uploadImg, oldpic, or imgurl parameter. | |||