CVE-2016-9045

🗓️ 17 Sep 2018 15:00:00Reported by talosType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

A code execution vulnerability in ProcessMaker Enterprise Core 3.0.1.7-community allows execution of PHP code via unsafe deserialization

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2016-9045	17 Sep 201818:18	–	circl
CNVD	ProcessMaker Enterprise Core Code Execution Vulnerability	19 Sep 201800:00	–	cnvd
Cvelist	CVE-2016-9045	17 Sep 201815:00	–	cvelist
EUVD	EUVD-2016-9866	7 Oct 202500:30	–	euvd
NVD	CVE-2016-9045	17 Sep 201815:29	–	nvd
Prion	Remote code execution	17 Sep 201815:29	–	prion
Positive Technologies	PT-2018-5061 · Processmaker · Processmaker Enterprise Core	17 Sep 201800:00	–	ptsecurity
seebug.org	ProcessMaker Enterprise Core Code Execution Vulnerability(CVE-2016-9045)	14 Sep 201700:00	–	seebug
Talos	ProcessMaker Enterprise Core Code Execution Vulnerability	19 Jul 201700:00	–	talos
Talos Blog	Vulnerabilities in ProcessMaker, WebFOCUS, and OpenFire Identified and Patched	19 Jul 201709:13	–	talosblog

NVD

Vulners

Node

processmaker processmakerMatch3.0.1.7enterprise

[
  {
    "product": "ProcessMaker Enterprise",
    "vendor": "ProcessMaker",
    "versions": [
      {
        "status": "affected",
        "version": "ProcessMaker Enterprise Core 3.0.1.7-community"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0314

Parameter	Position	Path	Description	CWE
d	query param	/sysworkflow/en/neoclassic/login/sysLoginVerify.php	Unsafe deserialization via base64-encoded parameter 'd' leading to potential PHP code execution.	CWE-502

21 Nov 2024 03:00Current

8.7High risk

Vulners AI Score8.7

CVSS 26.5

CVSS 3.18.8

CVSS 38.8

EPSS0.00579

CWE-502