ID:5146 - Exploit for Path traversal in Backup by Supsystic

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to delete arbitrary files on the server.

The vulnerability exists due to input validation error when processing directory traversal sequences passed via the "filename" parameter. A remote user can send a specially crafted HTTP request and delete arbitrary files on the system.

Note, the vulnerability can be exploited via CSRF attack vector.

Remediation