PT-2018-5679 · Wondercms · Wondercms

Samrat Das · Publicado 2018-01-26 · Atualizado 2024-08-05 · CVE-2017-14523

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1

Description: The issue allows for an HTTP Host header injection attack. It utilizes user-entered values to redirect pages. The vendor notes that exploitation is unlikely since the attack can only originate from a local machine or from the administrator as a self-attack.

Recommendations: For WonderCMS version 2.3.1, consider restricting the use of user-entered values in page redirects until a fix is available. As a temporary workaround, limit the ability to modify redirect pages to authorized personnel only.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-14523

Produtos afetados

Wondercms

Referências · 5

• 🔥 https://exploit-db.com/exploits/43964 · Exploit
• 🔥 https://securitywarrior9.blogspot.in/2018/01/host-header-injection-in-wonder-cms.html · Exploit
• https://t.me/cvenotify/89272 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-14523 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-14523 · Aviso do Fabricante