PT-2019-18279 · Thinkcmf · Thinkcmf

Published 2019-01-23 · Updated 2019-04-12 · CVE-2019-6713

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThinkCMF version 5.0.190111

Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using specific vectors involving the portal/List/index and list/:id endpoints to inject code into the data/conf/route.php file. For example, this can be demonstrated by a file put contents call.

Recommendations For ThinkCMF version 5.0.190111, consider restricting access to the portal/List/index and list/:id endpoints until a patch is available. As a temporary workaround, avoid using the file put contents function in the RouteController.php file to prevent code injection.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-6713

Affected Products

Thinkcmf

References · 4

• https://osv.dev/vulnerability/CVE-2019-6713 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6713 · Security Note
• https://thinkcmf.com/download.html · Vendor Advisory
• http://ttk7.cn/post-108.html · Note