CVE-2019-17370

OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFiledeal.php blocks "into outfile" in a SELECT statement, but does not block the "into//outfile" manipulation. Therefore, the attacker can create a .php file...

CVE-2019-17370

OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFiledeal.php blocks "into outfile" in a SELECT statement, but does not block the "into//outfile" manipulation. Therefore, the attacker can create a .php file...

CVE-2019-17370

CVE-2019-17370 affects OTCMS v3.85. The vulnerability arises because admin/sysCheckFile_deal.php blocks only into outfile in a SELECT, while bypassing with into/**/outfile, enabling an attacker to create a PHP file and achieve arbitrary PHP code execution. Connected sources corroborate this behav...