A vulnerability has been discovered in OSClass, which can be exploited by malicious users to compromise a vulnerable system and by malicious people to manipulate certain data.
The vulnerability is caused due to the oc-content/themes/modern/combine.php script not verifying file names before creating cache files. This can be exploited to e.g. overwrite arbitrary files or copy certain files to an arbitrary path via directory traversal sequences.
Note: This can further be exploited to download certain files or execute arbitrary PHP code by renaming an uploaded file.
The vulnerability is confirmed in version 2.3.5. Prior versions may also be affected.
