PT-2019-14621 · S Cms · S-Cms

Published 2019-09-14 · Updated 2019-09-16 · CVE-2019-16312

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions s-cms version V3.0

Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs in the index.php file when the type parameter is set to 'text' and the S id parameter is manipulated.

Recommendations For s-cms version V3.0, consider restricting access to the index.php file or validating and sanitizing the S id parameter to prevent malicious input. As a temporary workaround, avoid using the S id parameter in the index.php file with the type set to 'text' until a proper fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-16312

Affected Products

S-Cms

References · 3

• 🔥 http://iwantacve.cn/index.php/archives/320 · Exploit
• https://osv.dev/vulnerability/CVE-2019-16312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16312 · Security Note