CVE-2019-9609: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/comn/service/editUploadImage URI...

CVE-2019-9611: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in OFCMS before 1.1.3. It allows admin/cms/template/getTemplates.html?respath=res directory traversal, with ../ in the dir parameter, to write arbitrary content in the filecontent parameter into an arbitrary file specified by the filename parameter. This is related to the...

PT-2019-19756

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue allows remote attackers to execute arbitrary code. The blocking of .jsp and .jspx files does not consider certain file extensions, such as file.jsp::$DATA, when accessing the...

CVE-2019-9608: Unrestricted Upload of File with Dangerous Type

An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadImage URI...

CVE-2019-9614: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in OFCMS before 1.1.3. A command execution vulnerability exists via a template file with ' $ ex"' followed by the command...

PT-2019-19754

Name of the Vulnerable Software and Affected Versions OFCMS versions prior to 1.1.3 Description An issue in OFCMS allows SQL injection, related to the SystemGenerateController.java file. This is specifically exploitable through the "admin/system/generate/create" API endpoint with the sql paramete...