PT-2017-14630 · Lvye · Lvyecms

Published 2017-11-20 · Updated 2017-12-12 · CVE-2017-16903

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1

Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved through directory traversal sequences in the dir parameter, combined with PHP code in the content parameter, within a template Style add request to "index.php".

Recommendations For versions prior to 3.1, consider disabling the template Style add functionality in index.php until a patch is available. Restrict access to the dir and content parameters to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-16903

Affected Products

Lvyecms

References · 3

• 🔥❌ https://github.com/SQYY/CVE/blob/master/Lvyecms_G.txt · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2017-16903 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16903 · Vendor Advisory