CWE Code: 22
Vulnerability Type: privilege_escalation
CVSS Score: 6.5
CWE Name:  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary: an issue was discovered in total.js cms 12.0.0. an authenticated user with the pages privilege can conduct a path traversal attack (../) to include .html files that are outside the permitted directory. also, if a page contains a template directive, then the directive will be server side processed. thus, if a user can control the content of a .html file, then they can inject a payload with a malicious template directive to gain remote command execution. the exploit will work only with the .html extension.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-09-05
Last Modified Date: 2019-09-06