PT-2019-7553 · Redaxo · Redaxo

Published 2019-05-24 · Updated 2019-05-28 · CVE-2016-10757

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redaxo version 5.2.0

Description The issue affects the cron management in the admin panel, where a CSRF vulnerability can lead to arbitrary Remote Code Execution. This is achieved through the addons/cronjob/lib/types/phpcode.php file.

Recommendations For Redaxo version 5.2.0, consider disabling access to the addons/cronjob/lib/types/phpcode.php file as a temporary workaround until a patch is available. Restrict access to the cron management feature in the admin panel to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-10757

Affected Products

Redaxo

References · 4

• 🔥 https://blog.ripstech.com/2016/redaxo-remote-code-execution-via-csrf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10757 · Security Note
• https://osv.dev/vulnerability/CVE-2016-10757 · Vendor Advisory
• https://demo.ripstech.com/projects/redaxo_5.2.0 · Note