PT-2021-22589 · Yakamara Media · Redaxo Cms

Evildrummer · Published 2021-09-09 · Updated 2022-03-31 · CVE-2021-39459

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Yakamara Media Redaxo CMS version 5.12.1

Description: The issue allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code. This is achieved through the modules component in the CMS.

Recommendations: For Yakamara Media Redaxo CMS version 5.12.1, consider disabling the modules component until a patch is available to prevent remote code execution. Restrict access to the CMS to minimize the risk of exploitation by authenticated users.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-39459

Affected Products

Redaxo Cms

References · 5

• 🔥❌ https://github.com/evildrummer/CVE-2021-XYZ · Exploit, Deleted
• 🔥 https://github.com/evildrummer/MyOwnCVEs/tree/main/CVE-2021-39459 · Exploit
• https://osv.dev/vulnerability/CVE-2021-39459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39459 · Security Note
• https://t.me/cibsecurity/28574 · Telegram Post