CVE-2010-5094

Published: Aug 26, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The deleteinstallfiles function in control/ContentController.php in SilverStripe 2.3.x before 2.3.7 does not require ADMIN permissions, which allows remote attackers to delete index.php and "disrupt mod_rewrite-less URL routing."

Affected (12)

Products: Silverstripe: Silverstripe

Silverstripe

1 product

Silverstripe

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Silverstripe Silverstripe	Version 2.3.0
Silverstripe Silverstripe	Version 2.3.0 rc1
Silverstripe Silverstripe	Version 2.3.0 rc2
Silverstripe Silverstripe	Version 2.3.0 rc3
Silverstripe Silverstripe	Version 2.3.1
Silverstripe Silverstripe	Version 2.3.1 rc1
Silverstripe Silverstripe	Version 2.3.1 rc2
Silverstripe Silverstripe	Version 2.3.2
Silverstripe Silverstripe	Version 2.3.3
Silverstripe Silverstripe	Version 2.3.4
Silverstripe Silverstripe	Version 2.3.5
Silverstripe Silverstripe	Version 2.3.6