CVE-2012-5231

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

CVE-2012-5231

CVE-2012-5231 affects miniCMS 1.0 and 2.0. The vulnerability arises from improper handling of an executable extension in user-controlled fields (pagename or area) when update.php writes to content/ and in updatenews.php when writing to content/news/. This results in remote attackers being able to...