onefilecms.php in OneFileCMS through 2017-10-09 might allow attackers to delete anyfile or folders they want on the delete screen

access http://fragrant:30001/OneFileCMS/onefilecms.php by username/password

![image](https://user-images.githubusercontent.com/22767054/42224826-96c5a32a-7f0d-11e8-81fe-bebd3494af8f.png)

access http://fragrant:30001/OneFileCMS/onefilecms.php?i=var/www/html/&f=123.php&p=edit&p=deletefile

![image](https://user-images.githubusercontent.com/22767054/42224881-bdd58138-7f0d-11e8-9796-c963e9ef5d54.png)

Click `Delete File(s)`

![image](https://user-images.githubusercontent.com/22767054/42225002-155834d2-7f0e-11e8-8a5e-ac2c9b54638b.png)




Provide feedback

Saved searches

Use saved searches to filter your results more quickly

onefilecms.php in OneFileCMS through 2017-10-09 might allow attackers to delete anyfile or folders they want on the delete screen #49

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

onefilecms.php in OneFileCMS through 2017-10-09 might allow attackers to delete anyfile or folders they want on the delete screen #49

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions