exploitDog

CVE-2018-10086

Опубликовано: 13 апр. 2018

Источник: nvd

CVSS3: 7.2

CVSS2: 6.5

EPSS Низкий

Описание

CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.

Ссылки

https://github.com/itodaro/cve/blob/master/README.md
Exploit
Technical Description
Third Party Advisory
https://github.com/itodaro/cve/blob/master/README.md
Exploit
Technical Description
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cmsmadesimple:cms_made_simple:*:*:*:*:*:*:*:*

Версия до 2.2.7 (включая)

EPSS

Процентиль: 76%

0.00967

Низкий

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-hmxf-pqc3-jxh9

CVSS3: 7.2

github

больше 3 лет назад

CMS Made Simple (CMSMS) through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval('function testfunction'.rand()" and it is possible to bypass certain restrictions on these "testfunction" functions.

EPSS

Процентиль: 76%

0.00967

Низкий

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94