PT-2017-14252 · Phpcms · Phpcms

Publicado 2017-10-24 · Atualizado 2017-10-31 · CVE-2017-15872

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpwcms version 1.8.9

Description The issue concerns a problem with user input validation, allowing for malicious code execution. Specifically, it affects the username field, also known as new login. This can be exploited in certain templates, notably include/inc tmpl/admin.edituser.tmpl.php and include/inc tmpl/admin.newuser.tmpl.php.

Recommendations For phpwcms version 1.8.9, consider validating and sanitizing user input in the username field to prevent malicious code execution. As a temporary workaround, restrict access to the affected templates until a proper fix is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-15872

Produtos afetados

Phpcms

Referências · 5

• https://github.com/slackero/phpwcms/commit/90ee94a474b37919161f8112f9e36c53ad70492f · Correção
• https://github.com/slackero/phpwcms/commit/62c7c4a7a7de5effa0a82c89e77e53795a82e11d · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15872 · Nota
• https://osv.dev/vulnerability/CVE-2017-15872 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15872 · Nota de Segurança