Описание
v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.
Ссылки
- PatchThird Party Advisory
- https://user-images.githubusercontent.com/31153532/33065202-21b536f2-cee3-11e7-997a-c7d4f1b00ca7.jpgThird Party Advisory
- PatchThird Party Advisory
- https://user-images.githubusercontent.com/31153532/33065202-21b536f2-cee3-11e7-997a-c7d4f1b00ca7.jpgThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:finecms:finecms:5.2.0:*:*:*:*:*:*:*
EPSS
Процентиль: 72%
0.0071
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.
EPSS
Процентиль: 72%
0.0071
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
NVD-CWE-noinfo