up.time 7.5.0 Arbitrary File Disclose And Delete Exploit

The next-generation of IT monitoring software.

Input passed to the 'file_name' parameter in 'get2post.php' script is not properly sanitised before being used to get the contents of a resource and delete files. This can be exploited to read and delete arbitrary data from local resources with the permissions of the web server using a proxy tool.