PT-2012-5843 · Minicms · Minicms

Or4Ng.M4N · Publicado 2012-10-01 · Atualizado 2017-08-29 · CVE-2012-5231

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions miniCMS versions 1.0 through 2.0

Description The issue allows remote attackers to execute arbitrary PHP code via crafted pagename or area variables containing executable extensions. This is due to improper handling by update.php when writing files to content/, or by updatenews.php when writing files to content/news/.

Recommendations For miniCMS versions 1.0 through 2.0, consider disabling the update.php and updatenews.php scripts until a patch is available to prevent arbitrary PHP code execution. Restrict access to the content/ and content/news/ directories to minimize the risk of exploitation. Avoid using the pagename and area variables in the affected scripts until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-5231

Produtos afetados

Minicms

Referências · 5

• 🔥 http://securityfocus.com/bid/51612 · Exploit
• 🔥 https://exploit-db.com/exploits/18410 · Exploit
• 🔥 http://exploit-db.com/exploits/18410 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72645 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5231 · Nota de Segurança