PHPCMS 2008 type.php Code Injection (CVE-2018-19127)

A code injection vulnerability exists in PHPCMS 2008. An attacker could write arbitrary content to a website cache file with a controllable filename. Successful exploitation of this vulnerability could lead to arbitrary code execution...

CVE-2018-19127

PHPCMS 2008 is vulnerable to unauthenticated remote code execution (RCE) via a code injection flaw in the /type.php file. Attackers can exploit the 'template' parameter to write arbitrary content into a website cache file with a controllable filename, specifically within data/cache_template/*.tpl...