2020-08-24 14:45:55
mitre
PUBLISHED
DBHcms v1.2.0 has an Arbitrary file write vulnerability in dbhcmsmodmod.editor.php $_POST[updatefile] is filename and $_POST[tinymce_content] is file content, there is no filter function for security. A remote authenticated admin user can exploit this vulnerability to get a webshell.