Description
In webERP 4.15, Z_CreateCompanyTemplateFile.php has Incorrect Access Control, leading to the overwrite of an existing .sql file on the target web site by creating a template and then using ../ directory traversal in the TemplateName parameter.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP-Lister Lite for eBay Cross-Site Scripting (2.0.8.3)
SugarCRM Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-17307)
Jboss EAP CVE-2012-5626 Vulnerability (CVE-2012-5626)
SharePoint CVE-2022-41060 Vulnerability (CVE-2022-41060)
Joomla! Core 3.x.x Cross-Site Request Forgery (3.2.0 - 3.4.1)