Description
The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt mod_rewrite-less URL routing."
Remediation
References
Related Vulnerabilities
MySQL CVE-2021-2160 Vulnerability (CVE-2021-2160)
Envoy Proxy Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2019-15225)
Telerik Web UI Deserialization of Untrusted Data Vulnerability (CVE-2019-18935)
WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-60294)
WordPress Plugin Frontend File Manager Arbitrary File Upload (3.9)