PT-2019-19252 · Wtcms · Wtcms

Assassins-White · Published 2019-02-18 · Updated 2021-07-21 · CVE-2019-8908

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0

Description An issue in WTCMS allows remote attackers to execute arbitrary PHP code. This can be achieved by accessing the "Setting -> Mailbox configuration -> Registration email template" screen and uploading an image file with a .php filename, while setting the Content-Type header to image/gif.

Recommendations For WTCMS version 1.0, as a temporary workaround, consider restricting access to the "Setting -> Mailbox configuration -> Registration email template" screen until a patch is available. Avoid uploading files with executable extensions, such as .php, in the registration email template. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-706

Related Identifiers

CVE-2019-8908

Affected Products

Wtcms

References · 3

• 🔥 https://github.com/taosir/wtcms/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-8908 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8908 · Vendor Advisory