Lucene search
HistoryJun 02, 2014 - 3:55 p.m.
CVE-2013-1412
datalife engine
dle 9.7
remote execution
arbitrary php code
cve-2013-1412
nvd
7.4 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.967 High
EPSS
Percentile
99.6%
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
| CPE | Name | Operator | Version |
|---|---|---|---|
| dleviet:datalife_engine | dleviet datalife engine | eq | 9.7 |
Related
packetstorm
packetstorm
DataLife Engine 9.7 PHP Code Injection
2013-01-29 00:00:00
Datalife Engine 9.7 preview.php Bindshell
2015-12-14 00:00:00
DataLife Engine preview.php PHP Code Injection
2013-02-01 00:00:00
exploitpack
exploitpack
DataLife Engine 9.7 - preview.php PHP Code Injection
2013-01-28 00:00:00
prion
prion
Code injection
2014-06-02 15:55:00
checkpoint_advisories
checkpoint_advisories
DataLife Engine preview.php PHP Code Injection (CVE-2013-1412)
2013-06-06 00:00:00
securityvulns
securityvulns
openvas
openvas
DataLife Engine 'catlist' Parameter PHP Code Injection Vulnerability
2013-02-02 00:00:00
exploitdb
exploitdb
DataLife Engine 9.7 - 'preview.php' PHP Code Injection
2013-01-28 00:00:00
7.4 High
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.967 High
EPSS
Percentile
99.6%
Related for CVE-2013-1412