File Management System Php
Monthly
Unauthenticated remote attackers can delete arbitrary folders in oretnom23 file-management-system-php by invoking the delete_folder action in ajax.php and manipulating the ID argument; the endpoint lacks an authentication check (CWE-306). Publicly available exploit code exists, but no CISA KEV active-exploitation indication was provided in the available data. The issue is medium severity (CVSS 5.5) with low integrity and availability impact, and affected deployments are rolling-release with no fixed version identified while the maintainer has not responded to the report.
Unrestricted file upload in oretnom23's file-management-system-php lets remote attackers supply files of unrestricted type through the save_files function in admin_class.php, with potential server-side code execution if uploaded files land in a web-accessible directory that executes PHP. Affected code includes deployments at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4, and no fixed release is identified because the project uses rolling releases and has not responded to the issue report; publicly available exploit code exists. The supplied CVSS 4.0 vector lists PR:N, but the handler's administrative location leaves authentication requirements unconfirmed and no CISA KEV confirmation of active exploitation was provided.
SQL injection in oretnom23's file-management-system-php allows unauthenticated remote attackers to inject arbitrary SQL through the fid and id parameters of files.php, letting them read or tamper with the data the File Management component stores. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) metric against a 6.9 base score; the issue is not in CISA KEV, and the vendor was notified via an issue report but has not responded. Impact is bounded to limited confidentiality, integrity and availability loss (C:L/I:L/A:L) rather than full database or host takeover, and because the project ships as a rolling release no version-specific fix has been published.
SQL injection in oretnom23 file-management-system-php (download.php) allows unauthenticated remote attackers to manipulate the 'ID' parameter and execute arbitrary SQL statements against the backend database. Publicly available exploit code exists, and the project uses a rolling release with no fixed version; the maintainer has not responded to the issue report. Although the CVSS 4.0 vector indicates network-reachable, low-complexity exploitation without authentication or user interaction, real-world exposure is limited by the project's obscurity and negligible installation base, and remediation currently depends on manual code patching or removing the component.
SQL injection in the PHP-based File Management System (oretnom23/file-management-system-php) allows remote attackers to inject arbitrary SQL through the save_folder, delete_folder, delete_file, file_rename, and save_files functions in admin_class.php, with malicious values supplied in the name, parent_id, id, type, folder_id, or description parameters. Publicly available exploit code exists (documented in GitHub issue #4 and VulDB), though there is no CISA KEV confirmation of active exploitation. The project uses a rolling-release model with no tagged versions, so no fixed build can be specified, and the maintainer has not responded to the report; because the vulnerable routines sit in the admin class, real-world exploitability hinges on whether the administrative interface is reachable without a valid admin session - a discrepancy between the supplier's PR:N vector and the more likely PR:L assessment that defenders must verify.
SQL injection in oretnom23 File Management System (file-management-system-php) allows remote attackers to supply malicious name, username, password, type, or id values to the save_user function in admin_class.php, potentially reading or altering backend database contents. The project uses a rolling-release model, so no fixed version is published, and publicly available exploit code exists. Because save_user sits in the admin/user-management area, risk is highest where admin_class.php is reachable without enforced authentication or access control; the independent assessment models this as requiring low privileges (PR:L).
SQL injection in the Login function of oretnom23's file-management-system-php allows remote, unauthenticated attackers to manipulate the username and password parameters and alter the SQL used during the admin authentication flow. The assessment rates confidentiality, integrity, and availability impact as low, and affected deployments are identified only up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 because the project uses rolling releases. Public exploit code exists, but no CISA KEV entry or confirmed active exploitation was provided.
Path/file inclusion in oretnom23 File Management System PHP lets remote attackers influence the 'page' parameter processed by index.php's include() call, enabling limited local file disclosure or inclusion of attacker-controlled content. The application is distributed as a rolling release with no version identifiers, and the project has not provided a fixed build. No authentication is required (PR:N) but exploitation depends on passive user interaction (UI:P); publicly available exploit code exists, and impact is assessed as LOW (C:L/I:L/A:L).
Unauthenticated remote attackers can delete arbitrary folders in oretnom23 file-management-system-php by invoking the delete_folder action in ajax.php and manipulating the ID argument; the endpoint lacks an authentication check (CWE-306). Publicly available exploit code exists, but no CISA KEV active-exploitation indication was provided in the available data. The issue is medium severity (CVSS 5.5) with low integrity and availability impact, and affected deployments are rolling-release with no fixed version identified while the maintainer has not responded to the report.
Unrestricted file upload in oretnom23's file-management-system-php lets remote attackers supply files of unrestricted type through the save_files function in admin_class.php, with potential server-side code execution if uploaded files land in a web-accessible directory that executes PHP. Affected code includes deployments at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4, and no fixed release is identified because the project uses rolling releases and has not responded to the issue report; publicly available exploit code exists. The supplied CVSS 4.0 vector lists PR:N, but the handler's administrative location leaves authentication requirements unconfirmed and no CISA KEV confirmation of active exploitation was provided.
SQL injection in oretnom23's file-management-system-php allows unauthenticated remote attackers to inject arbitrary SQL through the fid and id parameters of files.php, letting them read or tamper with the data the File Management component stores. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) metric against a 6.9 base score; the issue is not in CISA KEV, and the vendor was notified via an issue report but has not responded. Impact is bounded to limited confidentiality, integrity and availability loss (C:L/I:L/A:L) rather than full database or host takeover, and because the project ships as a rolling release no version-specific fix has been published.
SQL injection in oretnom23 file-management-system-php (download.php) allows unauthenticated remote attackers to manipulate the 'ID' parameter and execute arbitrary SQL statements against the backend database. Publicly available exploit code exists, and the project uses a rolling release with no fixed version; the maintainer has not responded to the issue report. Although the CVSS 4.0 vector indicates network-reachable, low-complexity exploitation without authentication or user interaction, real-world exposure is limited by the project's obscurity and negligible installation base, and remediation currently depends on manual code patching or removing the component.
SQL injection in the PHP-based File Management System (oretnom23/file-management-system-php) allows remote attackers to inject arbitrary SQL through the save_folder, delete_folder, delete_file, file_rename, and save_files functions in admin_class.php, with malicious values supplied in the name, parent_id, id, type, folder_id, or description parameters. Publicly available exploit code exists (documented in GitHub issue #4 and VulDB), though there is no CISA KEV confirmation of active exploitation. The project uses a rolling-release model with no tagged versions, so no fixed build can be specified, and the maintainer has not responded to the report; because the vulnerable routines sit in the admin class, real-world exploitability hinges on whether the administrative interface is reachable without a valid admin session - a discrepancy between the supplier's PR:N vector and the more likely PR:L assessment that defenders must verify.
SQL injection in oretnom23 File Management System (file-management-system-php) allows remote attackers to supply malicious name, username, password, type, or id values to the save_user function in admin_class.php, potentially reading or altering backend database contents. The project uses a rolling-release model, so no fixed version is published, and publicly available exploit code exists. Because save_user sits in the admin/user-management area, risk is highest where admin_class.php is reachable without enforced authentication or access control; the independent assessment models this as requiring low privileges (PR:L).
SQL injection in the Login function of oretnom23's file-management-system-php allows remote, unauthenticated attackers to manipulate the username and password parameters and alter the SQL used during the admin authentication flow. The assessment rates confidentiality, integrity, and availability impact as low, and affected deployments are identified only up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 because the project uses rolling releases. Public exploit code exists, but no CISA KEV entry or confirmed active exploitation was provided.
Path/file inclusion in oretnom23 File Management System PHP lets remote attackers influence the 'page' parameter processed by index.php's include() call, enabling limited local file disclosure or inclusion of attacker-controlled content. The application is distributed as a rolling release with no version identifiers, and the project has not provided a fixed build. No authentication is required (PR:N) but exploitation depends on passive user interaction (UI:P); publicly available exploit code exists, and impact is assessed as LOW (C:L/I:L/A:L).