PT-2018-15411 · 74Cms · 74Cms

Publicado 2018-12-27 · Atualizado 2019-01-24 · CVE-2018-20519

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111

Description An issue in 74cms allows remote authenticated users to read or modify arbitrary resumes. This is achieved by changing a job-search intention, specifically through the "index.php?c=Personal&a=ajax save basic" endpoint, by manipulating the pid parameter.

Recommendations For version 4.2.111, consider restricting access to the "ajax save basic" function in the "Personal" controller to prevent unauthorized modification of resumes. As a temporary workaround, avoid using the pid parameter in the affected endpoint until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-20519

Produtos afetados

74Cms

Referências · 3

• 🔥❌ https://github.com/coolboy0816/audit/issues/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-20519 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-20519 · Nota de Segurança