Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive configuration files by force browsing the “/Admin/file_manager/file_details.asp” endpoint and manipulating the “file” parameter. By referencing specific files (e.g., cm3.xml), the attacker can retrieve system administrator credentials, SMTP settings, database credentials, and other confidential information. The exposure of this information can lead to full administrative access to the CMS, unauthorized access to email services, compromise of backend databases, lateral movement within the network, and long-term persistence by an attacker. This access control bypass poses a critical risk of account takeover, privilege escalation, and systemic compromise of the affected application and its associated infrastructure.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
DDSN Interactive Acora CMS 安全漏洞
Vulnerability Description
DDSN Interactive Acora CMS是DDSN Interactive公司的一个企业网络和移动 CMS。 DDSN Interactive Acora CMS v10.7.1存在安全漏洞，该漏洞源于file_details.asp端点访问控制不当，可能导致具有编辑器权限的攻击者访问敏感文件。
CVSS Information
N/A
Vulnerability Type
N/A