Описание
Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
Уязвимые конфигурации
Конфигурация 1Версия до 1.4.0 (включая)
cpe:2.3:a:cutephp:cutenews:*:*:*:*:*:*:*:*
EPSS
Процентиль: 85%
0.02429
Низкий
7.5 High
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
github
почти 4 года назад
Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip), which is injected into data/flood.db.php.
EPSS
Процентиль: 85%
0.02429
Низкий
7.5 High
CVSS2
Дефекты
NVD-CWE-Other