PT-2018-13993 · Otcms · Otcms

Xiaohuihui · Published 2018-09-23 · Updated 2018-11-08 · CVE-2018-17364

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OTCMS version 3.61

Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the accBackupDir parameter.

Recommendations For OTCMS version 3.61, consider restricting access to the vulnerable parameter accBackupDir to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Code Injection

Weakness Enumeration

CWE-362

CWE-94

Related Identifiers

CVE-2018-17364

Affected Products

Otcms

References · 3

• 🔥 https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-17364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17364 · Security Note