PT-2018-15411 · 74Cms · 74Cms

Published 2018-12-27 · Updated 2019-01-24 · CVE-2018-20519

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111

Description An issue in 74cms allows remote authenticated users to read or modify arbitrary resumes. This is achieved by changing a job-search intention, specifically through the "index.php?c=Personal&a=ajax save basic" endpoint, by manipulating the pid parameter.

Recommendations For version 4.2.111, consider restricting access to the "ajax save basic" function in the "Personal" controller to prevent unauthorized modification of resumes. As a temporary workaround, avoid using the pid parameter in the affected endpoint until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-20519

Affected Products

74Cms

References · 3

• 🔥❌ https://github.com/coolboy0816/audit/issues/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2018-20519 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20519 · Security Note