PT-2021-10745 · Phpcms · Phpcms

Blindkey · Published 2021-06-16 · Updated 2022-09-29 · CVE-2020-22201

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions phpCMS 2008 sp4

Description The issue allows remote malicious users to execute arbitrary php commands. This is achieved via the pagesize parameter to the "yp/product.php" endpoint.

Recommendations For phpCMS 2008 sp4, consider restricting access to the "yp/product.php" endpoint or avoid using the pagesize parameter until a fix is available.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-22201

Affected Products

Phpcms

References · 4

• 🔥 https://github.com/blindkey/cve_like/issues/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-22201 · Security Note
• https://osv.dev/vulnerability/CVE-2020-22201 · Vendor Advisory
• https://cwe.mitre.org/data/definitions/95.html · Note