PT-2019-19880 · Maccms · Maccms

Published 2019-03-15 · Updated 2021-07-21 · CVE-2019-9829

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maccms version 10

Description The issue allows remote attackers to execute arbitrary PHP code by entering this code in a template/default pc/html/art Edit action. This occurs because template rendering uses an include operation on a cache file, which bypasses the prohibition of .php files as templates.

Recommendations For Maccms version 10, consider restricting access to the template rendering functionality to minimize the risk of exploitation. As a temporary workaround, avoid using the template/default pc/html/art Edit action until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2019-9829

Affected Products

Maccms

References · 3

• 🔥 https://github.com/guobaoyou/vul_environment/blob/master/maccms10_getshell/maccms10_getshell_en.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-9829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9829 · Security Note