PT-2019-18279 · Thinkcmf · Thinkcmf

Publicado 2019-01-23 · Atualizado 2019-04-12 · CVE-2019-6713

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkCMF version 5.0.190111

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using specific vectors involving the portal/List/index and list/:id endpoints to inject code into the data/conf/route.php file. For example, this can be demonstrated by a file put contents call.

Recommendations For ThinkCMF version 5.0.190111, consider restricting access to the portal/List/index and list/:id endpoints until a patch is available. As a temporary workaround, avoid using the file put contents function in the RouteController.php file to prevent code injection.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2019-6713

Produtos afetados

Thinkcmf

Referências · 4

• http://ttk7.cn/post-108.html · Nota
• https://osv.dev/vulnerability/CVE-2019-6713 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-6713 · Nota de Segurança
• https://thinkcmf.com/download.html · Aviso do Fabricante