sandboxescape/ProjectSend-multiple-vulnerabilities

Releases0

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2016-10732 ↗	Oct 29, 2018Monday, 29 October 2018, 12:29	—	7.5 HIGH
ProjectSend (formerly cFTP) r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?file_id=1, or process-zip-download.php, or add_user_form_* parameters to users-add.php.
CVE-2016-10733 ↗	Oct 29, 2018Monday, 29 October 2018, 12:29	—	7.5 HIGH
ProjectSend (formerly cFTP) r582 allows directory traversal via file=../ in the process-zip-download.php query string.
CVE-2016-10734 ↗	Oct 29, 2018Monday, 29 October 2018, 12:29	—	7.5 HIGH
ProjectSend (formerly cFTP) r582 allows Insecure Direct Object Reference via includes/actions.log.export.php.
CVE-2016-10731 ↗	Oct 29, 2018Monday, 29 October 2018, 12:29	—	7.5 HIGH
ProjectSend (formerly cFTP) r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selected_clients, clients.php with the request parameter status, process-zip-download.php with the request parameter file, or home-log.php with the request parameter action.