ProjectCMS File Upload and Information Disclosure Vulnerabilities
Description
Multiple vulnerabilities have been identified in ProjectCMS, which could be exploited by attackers to disclose or manipulate certain information, or compromise a vulnerable web server.
The first issue is caused by missing authentication in the "addons/imagelibrary/insert_image.php" script, which could be exploited by remote attackers to upload malicious PHP scripts and execute arbitrary commands with the privileges of the web server.
The second vulnerability is caused by missing authentication and an input validation error in the "admin_includes/admin_theme_remove.php" script when processing the "file" parameter, which could allow attackers to delete arbitrary folders via a directory traversal.
The third issue is caused by a design error in the "addons/imagelibrary/select_image.php" script when processing the "dir" parameter, which could be exploited by attackers to disclose the contents of arbitrary directories.
Vulnerable Products
Vulnerable Software: ProjectCMS version 1.1 Beta and prior
