PT-2019-12267 · Soy · Soy Cms

Ryan0Lb + 1 · Publicado 2019-04-20 · Atualizado 2024-08-04 · CVE-2019-11376

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOY CMS version 3.0.2

Description The issue allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. It is based on an assumption that the content is made editable on its own.

Recommendations For SOY CMS version 3.0.2, consider removing or restricting the ability to input PHP code in the second text box as a temporary workaround until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-11376

Produtos afetados

Soy Cms

Referências · 4

• 🔥 https://github.com/inunosinsi/soycms/issues/5 · Exploit
• 🔥 http://iwantacve.cn/index.php/archives/212 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11376 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11376 · Nota de Segurança