Описание
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call.
Ссылки
- Permissions RequiredThird Party Advisory
- Release NotesVendor Advisory
- Permissions RequiredThird Party Advisory
- Release NotesVendor Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:thinkcmf:thinkcmf:5.0.190111:*:*:*:*:*:*:*
EPSS
Процентиль: 78%
0.01155
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-94
Связанные уязвимости
CVSS3: 9.8
github
больше 3 лет назад
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a file_put_contents call.
EPSS
Процентиль: 78%
0.01155
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-94