PT-2019-13561 · Publisure · Publisure

Bourbon Jean-Marie + 1 · Publicado 2019-09-18 · Atualizado 2019-09-18 · CVE-2019-14252

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Publisure version 2.1.2

Description An issue in the secure portal of Publisure allows an authenticated administrator to inject arbitrary PHP code using the adminCons.php form. The injected code is stored in the E:PUBLISUREwebservicewebpagesAdminDirTemplates folder, and it remains even if removed from the adminCons.php view, potentially allowing the rogue PHP file to be hidden.

Recommendations For Publisure version 2.1.2, consider restricting access to the adminCons.php form to prevent arbitrary PHP code injection until a patch is available. As a temporary workaround, monitor and regularly clean up the E:PUBLISUREwebservicewebpagesAdminDirTemplates folder to remove any potentially malicious PHP files.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-14252

Produtos afetados

Publisure

Referências · 3

• 🔥 https://github.com/kmkz/exploit/blob/master/PUBLISURE-EXPLOIT-CHAIN-ADVISORY.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14252 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-14252 · Aviso do Fabricante