PT-2017-12120 · Finecms · Finecms

Lorexxar · Publicado 2017-07-24 · Atualizado 2017-07-28 · CVE-2017-11585

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9

Description The issue concerns remote PHP code execution via the param parameter in an "action=cache" request to "libraries/Template.php", which is an example of Eval Injection.

Recommendations For FineCms version 5.0.9, consider restricting access to the "libraries/Template.php" file to minimize the risk of exploitation, and avoid using the param parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-11585

Produtos afetados

Finecms

Referências · 3

• 🔥 http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#remote-php-code-execution · Exploit
• https://osv.dev/vulnerability/CVE-2017-11585 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11585 · Nota de Segurança