PT-2018-12589 · Golem · Golemcms

Published 2018-07-24 · Updated 2018-09-20 · CVE-2018-14579

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GolemCMS through 2008-12-24

Description The issue allows remote attackers to execute arbitrary PHP code by inserting this code into the Table prefix form field in the "Database Information" section, or obtain sensitive information via a direct request for install/install.sql, if the install/ directory remains active after an installation.

Recommendations For GolemCMS through 2008-12-24, remove or restrict access to the install/ directory after installation to prevent exploitation. As a temporary workaround, consider restricting access to the "Database Information" section to minimize the risk of arbitrary PHP code execution. Avoid using the Table prefix form field in the "Database Information" section until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-14579

Affected Products

Golemcms

References · 3

• 🔥 https://github.com/havysec/Useful_Code/blob/master/mycve/001.md · Exploit
• https://osv.dev/vulnerability/CVE-2018-14579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14579 · Security Note