CVE-2018-7308

Vulnerability

A CSRF vulnerability exists in var/www/html/files.php in DanWin hosting through 2018-02-11. The file lacks CSRF protection, allowing an attacker to perform actions on behalf of an authenticated administrator [1].

Exploitation

An attacker can craft a malicious link or page that, when visited by an authenticated admin, triggers arbitrary file operations (add, delete, modify) without the admin's consent [1]. No additional authentication is required for the attacker.

Impact

Successful exploitation enables the attacker to add, delete, or modify any files in any hosting account, leading to potential data loss, website defacement, or full account compromise [1].

Mitigation

As of the available references, no official fix has been released. Users should implement CSRF tokens in files.php or apply input validation until a patch is provided [1].