OTCMS Arbitrary PHP Code Execution Vulnerability

OTCMS is an article-based web content management system CMS. A security vulnerability exists in OTCMS version 3.61. The vulnerability can be exploited by remote attackers to execute arbitrary PHP code with the help of 'accBackupDir' parameter...

CVE-2018-17364

OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter...

CVE-2018-17364

OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter...

Code injection

OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter...

CVE-2018-17364

OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter...

CVE-2018-17364

CVE-2018-17364 affects OTCMS 3.61, where remote attackers can execute arbitrary PHP code via the accBackupDir parameter. Attack vector is network-based; exploitation details are not provided beyond the parameter abuse. Root cause: unvalidated/unsafe handling of accBackupDir allows code execution....

CVE-2018-17364: Improper Control of Generation of Code

OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter...

PT-2018-13993

Name of the Vulnerable Software and Affected Versions OTCMS version 3.61 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the accBackupDir parameter. Recommendations For OTCMS version 3.61, consider restricting access to the vulnerable parameter...