Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component “/hcms/admin/index.php/language/ajax.”
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-18178
Reference (s):
- https://github.com/Neeke/HongCMS/issues/11