CVE-2018-18702

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=importrule because the upfile content is base64 decoded, deserialized, and used for database insertion...

CVE-2018-18702

The CVE applies to iCMS v7.0.11, where spider.admincp.php is vulnerable to SQL injection via admincp.php?app=spider&do=import_rule. The vulnerability arises because upfile content is base64 decoded, deserialized, and used to form a database insertion, allowing for injected SQL. CVSS shows high se...