PT-2018-12794 · Seacms · Seacms
Published
2018-08-03
·
Updated
2018-10-02
·
CVE-2018-14910
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SeaCMS version 6.61
Description
The issue allows for remote code execution by inserting PHP code into an allowed IP address, which is then executed when visiting specific endpoints, such as
/admin/admin ip.php or /adm1n/admin ip.php, and also /data/admin/ip.php. This can also be exploited through Cross-Site Request Forgery (CSRF).Recommendations
For SeaCMS version 6.61, as a temporary workaround, consider restricting access to the
/admin/admin ip.php and /adm1n/admin ip.php endpoints, as well as /data/admin/ip.php, to minimize the risk of exploitation. Avoid using the ip variable in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
CSRF
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Seacms