PT-2018-18751

Name of the Vulnerable Software and Affected Versions Creditwest Bank CMS Project aka CWCMS through 2017-07-28 Description The issue allows remote attackers to inject arbitrary PHP code via CSRF in the site configuration update functionality. This can be demonstrated by a PHP shell that calls eva...

CVE-2018-8972: Cross-Site Request Forgery (CSRF)

Creditwest Bank CMS Project aka CWCMS through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters...