PT-2018-12589 · Golem · Golemcms

Publicado 2018-07-24 · Atualizado 2018-09-20 · CVE-2018-14579

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GolemCMS through 2008-12-24

Description The issue allows remote attackers to execute arbitrary PHP code by inserting this code into the Table prefix form field in the "Database Information" section, or obtain sensitive information via a direct request for install/install.sql, if the install/ directory remains active after an installation.

Recommendations For GolemCMS through 2008-12-24, remove or restrict access to the install/ directory after installation to prevent exploitation. As a temporary workaround, consider restricting access to the "Database Information" section to minimize the risk of arbitrary PHP code execution. Avoid using the Table prefix form field in the "Database Information" section until the issue is resolved.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2018-14579

Produtos afetados

Golemcms

Referências · 3

• 🔥 https://github.com/havysec/Useful_Code/blob/master/mycve/001.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-14579 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14579 · Nota de Segurança