PT-2018-10604 · Phpmywind · Phpmywind

Ik3O · Published 2018-05-26 · Updated 2018-06-27 · CVE-2018-11487

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5

Description The issue concerns a security problem where an attacker can inject malicious code. This is possible through the cid parameter to the "newsshow.php" endpoint, or the query string to the "news.php" or "about.php" endpoints.

Recommendations For PHPMyWind version 5.5, avoid using the cid parameter in the "newsshow.php" endpoint, and restrict access to the query strings in "news.php" and "about.php" until a fix is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-11487

Affected Products

Phpmywind

References · 3

• https://osv.dev/vulnerability/CVE-2018-11487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11487 · Security Note
• https://github.com/gaozhifeng/PHPMyWind/issues/2 · Note