PT-2017-11645 · Finecms · Finecms

Published 2017-07-07 · Updated 2017-07-17 · CVE-2017-10968

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FineCMS through 2017-07-07

Description The issue allows remote PHP code execution. This can be achieved by placing the code after "<?php" in a route=template request, specifically in the application/core/controller/template.php file.

Recommendations For FineCMS versions through 2017-07-07, consider restricting access to the template.php file in the application/core/controller directory to minimize the risk of exploitation. As a temporary workaround, avoid using the route=template request until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-10968

Affected Products

Finecms

References · 2

• 🔥 http://yuesec.com/img/cccccve/finecms_codeexec/finecmscodeexec_2017_07_06_submit.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-10968 · Security Note