ThinkAdmin v6 is affected by a directory traversal vulnerability. An unauthorized attacker can read arbitrarily file on a remote server via GET request encode parameter.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html | Third Party Advisory |
| https://github.com/zoujingli/ThinkAdmin/issues/244 | Exploit Third Party Advisory |
| https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/ | Exploit Third Party Advisory |
| http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html | Third Party Advisory |
| https://github.com/zoujingli/ThinkAdmin/issues/244 | Exploit Third Party Advisory |
| https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/159177/ThinkAdmin-6-Arbitrary-File-Read.html - Third Party Advisory | |
| References | () https://github.com/zoujingli/ThinkAdmin/issues/244 - Exploit, Third Party Advisory | |
| References | () https://wtfsec.org/posts/thinkadmin-v6-%E5%88%97%E7%9B%AE%E5%BD%95-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96/ - Exploit, Third Party Advisory |
07 Dec 2023, 14:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Thinkadmin
Thinkadmin thinkadmin |
|
| CPE | cpe:2.3:a:thinkadmin:thinkadmin:6.0:*:*:*:*:*:*:* |
Information
Published : 2020-09-14 13:15
Updated : 2024-11-21 05:18
NVD link : CVE-2020-25540
Mitre link : CVE-2020-25540
CVE.ORG link : CVE-2020-25540
JSON object : View
Products Affected
thinkadmin
- thinkadmin
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')