CVE-2018-7486

Blue River Mura CMS before v7.0.7029 supports inline function calls with an m tag and /m end tag, without proper restrictions on file types or pathnames, which allows remote attackers to execute arbitrary code via an m$.dspinclude"../pathname/executable.jpeg"/m approach, where executable.jpeg...

CVE-2018-7486

Blue River Mura CMS before v7.0.7029 is affected by an arbitrary code execution vulnerability. The issue arises from supporting inline function calls using [m]...[/m] tags without proper restrictions on file types or pathnames, enabling a remote attacker to trigger code execution via an [m]$.dspi...