PT-2017-14252 · Phpcms · Phpcms

Published 2017-10-24 · Updated 2017-10-31 · CVE-2017-15872

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpwcms version 1.8.9

Description The issue concerns a problem with user input validation, allowing for malicious code execution. Specifically, it affects the username field, also known as new login. This can be exploited in certain templates, notably include/inc tmpl/admin.edituser.tmpl.php and include/inc tmpl/admin.newuser.tmpl.php.

Recommendations For phpwcms version 1.8.9, consider validating and sanitizing user input in the username field to prevent malicious code execution. As a temporary workaround, restrict access to the affected templates until a proper fix is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-15872

Affected Products

Phpcms

References · 5

• https://github.com/slackero/phpwcms/commit/90ee94a474b37919161f8112f9e36c53ad70492f · Patch
• https://github.com/slackero/phpwcms/commit/62c7c4a7a7de5effa0a82c89e77e53795a82e11d · Patch
• https://osv.dev/vulnerability/CVE-2017-15872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15872 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15872 · Note