PT-2020-13129 · Subrion · Subrion Cms

Published 2020-04-29 · Updated 2022-05-24 · CVE-2020-12469

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Subrion CMS versions prior to 4.2.1

Description The issue concerns PHP Object Injection, which can lead to file deletion. This occurs through the subpages value within a block to blocks/edit, where an attacker can inject malicious serialized data.

Recommendations For Subrion CMS versions prior to 4.2.1, update to a version that contains a fix for this issue to prevent PHP Object Injection and potential file deletion.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-12469

GHSA-FMQQ-HW9M-448Q

Affected Products

Subrion Cms

References · 6

• 🔥 https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12469 · Security Note
• https://osv.dev/vulnerability/GHSA-fmqq-hw9m-448q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12469 · Vendor Advisory
• https://github.com/intelliants/subrion · Note
• https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection/readme · Note