CVE-2017-7625

Опубликовано: 10 апр. 2017

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/app_theme/libs/save_file.php" and then execute code.

Ссылки

http://www.securityfocus.com/bid/97571
Third Party Advisory
VDB Entry
https://github.com/Xyntax/POC-T/blob/2.0/script/fiyo2.0.7-getshell.py
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/97571
Third Party Advisory
VDB Entry
https://github.com/Xyntax/POC-T/blob/2.0/script/fiyo2.0.7-getshell.py
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:fiyo:fiyo_cms:2.0:*:*:*:*:*:*:*

cpe:2.3:a:fiyo:fiyo_cms:2.0.1.6:*:*:*:*:*:*:*

cpe:2.3:a:fiyo:fiyo_cms:2.0.1.8:*:*:*:*:*:*:*

cpe:2.3:a:fiyo:fiyo_cms:2.0.2.1:*:*:*:*:*:*:*

cpe:2.3:a:fiyo:fiyo_cms:2.0.6:*:*:*:*:*:*:*

cpe:2.3:a:fiyo:fiyo_cms:2.0.7:*:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01364

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-5h6w-56p3-f39c