PT-2012-6091 · Empirecms · Empirecms

Publicado 2012-11-16 · Atualizado 2017-08-29 · CVE-2012-5777

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions EmpireCMS version 6.6

Description The issue concerns an eval injection vulnerability in the ReplaceListVars function within the template parser, located in e/class/connect.php. This vulnerability allows user-assisted remote attackers to execute arbitrary PHP code by crafting a malicious template.

Recommendations For EmpireCMS version 6.6, consider disabling the ReplaceListVars function in the template parser until a patch is available to prevent the execution of arbitrary PHP code. Restrict access to the template parser to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2012-5777

Produtos afetados

Empirecms

Referências · 7

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-11/0027.html · Exploit
• http://securityfocus.com/bid/56406 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79779 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5777 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5777 · Nota
• http://packetstormsecurity.org/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html · Nota
• http://packetstormsecurity.com/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html · Nota