CVE-2017-14049

In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...

Design/Logic Flaw

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

Cross site request forgery (csrf)

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2017-13670

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

CVE-2017-14048

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2017-14050

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

Design/Logic Flaw

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

CVE-2017-14048

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2017-14049

In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...

CVE-2017-13670

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

CVE-2017-13670

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file...

CVE-2017-14050

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file...

CVE-2017-14049

In BlackCat CMS 1.2, backend/settings/ajaxsavesettings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field...

CVE-2017-13670

In BlackCat CMS 1.2, CVE-2017-13670 describes a vulnerability where remote authenticated users can upload arbitrary files through the media/upload AJAX endpoint (backend/media/ajax_upload.php), demonstrated by a ZIP containing a PHP file. The available documents do not specify an exact exploit pa...

CVE-2017-14048

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

CVE-2017-14048

BlackCat CMS 1.2 is affected. Remote authenticated users can inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php, enabling code execution. The issue is also exploitable via CSRF; root cause is insufficient validation in ajax_create.php....

CVE-2017-14050

In BlackCat CMS 1.2, backend/addons/install.php is vulnerable: remote authenticated users can execute arbitrary PHP code by uploading a ZIP archive containing a .php file. Root cause is improper handling/validation of uploaded PHP inside the ZIP, leading to remote code execution. Impact per sourc...

CVE-2017-14049

CVE-2017-14049 (BlackCat CMS 1.2) exposes a persistent XSS vulnerability in backend/settings/ajax_save_settings.php. The issue allows remote authenticated users to inject malicious content via the Website header or Website footer fields, potentially enabling script execution in the victim’s brows...

BlackCat CMS Arbitrary File Upload Vulnerability

BlackCat CMS is a PHP5, HTML5 content management system. An arbitrary file upload vulnerability exists in BlackCat CMS version 1.2, which allows remote attackers to upload arbitrary files via the media upload function in backend/media/ajaxupload.php...

BlackCat CMS Arbitrary PHP Code Execution Vulnerability

BlackCat CMS is a PHP5, HTML5 content management system. An arbitrary PHP code execution vulnerability exists in the backend/addons/install.php file in BlackCat CMS, which can be exploited by remote attackers to execute arbitrary PHP code via a ZIP archive containing the .php file...