PT-2020-7116 · Jcow Cms · Jcow Cms

Aung Khant · Published 2020-01-14 · Updated 2020-01-17 · CVE-2011-3203

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jcow CMS versions 4.x through 4.2 Jcow CMS versions 5.2

Description A Code Execution issue exists in the attachment parameter to "index.php" in Jcow CMS.

Recommendations For Jcow CMS versions 4.x through 4.2, avoid using the attachment parameter in the "index.php" endpoint until a fix is available. For Jcow CMS version 5.2, consider restricting access to the "index.php" endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-3203

Affected Products

Jcow Cms

References · 3

• 🔥 https://openwall.com/lists/oss-security/2011/08/30/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-3203 · Security Note
• https://t.me/cibsecurity/9178 · Telegram Post