PT-2017-14630 · Lvye · Lvyecms

Publicado 2017-11-20 · Atualizado 2017-12-12 · CVE-2017-16903

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1

Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved through directory traversal sequences in the dir parameter, combined with PHP code in the content parameter, within a template Style add request to "index.php".

Recommendations For versions prior to 3.1, consider disabling the template Style add functionality in index.php until a patch is available. Restrict access to the dir and content parameters to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-16903

Produtos afetados

Lvyecms

Referências · 3

• 🔥❌ https://github.com/SQYY/CVE/blob/master/Lvyecms_G.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2017-16903 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16903 · Aviso do Fabricante