PT-2019-19880 · Maccms · Maccms

Publicado 2019-03-15 · Atualizado 2021-07-21 · CVE-2019-9829

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maccms version 10

Description The issue allows remote attackers to execute arbitrary PHP code by entering this code in a template/default pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.

Recommendations For Maccms version 10, consider restricting access to the template rendering functionality to minimize the risk of exploitation. As a temporary workaround, avoid using the template/default pc/html/art Edit action until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2019-9829

Produtos afetados

Maccms

Referências · 3

• 🔥 https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-9829 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9829 · Nota de Segurança