PT-2012-5843 · Minicms · Minicms

Or4Ng.M4N · Published 2012-10-01 · Updated 2017-08-29 · CVE-2012-5231

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions miniCMS versions 1.0 through 2.0

Description The issue allows remote attackers to execute arbitrary PHP code via crafted pagename or area variables containing executable extensions. This is due to improper handling by update.php when writing files to content/, or by updatenews.php when writing files to content/news/.

Recommendations For miniCMS versions 1.0 through 2.0, consider disabling the update.php and updatenews.php scripts until a patch is available to prevent arbitrary PHP code execution. Restrict access to the content/ and content/news/ directories to minimize the risk of exploitation. Avoid using the pagename and area variables in the affected scripts until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2012-5231

Affected Products

Minicms

References · 5

• 🔥 http://securityfocus.com/bid/51612 · Exploit
• 🔥 https://exploit-db.com/exploits/18410 · Exploit
• 🔥 http://exploit-db.com/exploits/18410 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5231 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72645 · Note