exploitDog

CVE-2016-7791

Опубликовано: 12 янв. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads to arbitrary code execution.

Ссылки

http://www.openwall.com/lists/oss-security/2016/09/29/11
Exploit
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/93119
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2016/09/29/11
Exploit
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/bid/93119
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:exponentcms:exponent_cms:2.3.9:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.033

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-7mv2-gxmv-9mfg

CVSS3: 9.8

github

больше 3 лет назад

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads to arbitrary code execution.

EPSS

Процентиль: 87%

0.033

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-20