PT-2019-19450 · Baigo · Baigo Cms

Published 2019-02-28 · Updated 2019-02-28 · CVE-2019-9227

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions baigo CMS version 2.1.1

Description A remote code execution issue was discovered, allowing attackers to execute arbitrary code. This can be achieved by writing malicious code into the opt base.inc.php file using the BG SITE NAME parameter.

Recommendations For baigo CMS version 2.1.1, consider restricting access to the opt base.inc.php file to prevent modification, and avoid using the BG SITE NAME parameter until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-9227

Affected Products

Baigo Cms

References · 3

• 🔥 https://github.com/baigoStudio/baigoCMS/issues/8 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9227 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9227 · Security Note