471 matches found
CVE-2018-19595
PbootCMS V1.3.1 build 2018-11-14 is vulnerable to remote code execution via an eval-based input in the web layer. The issue stems from an insufficient protection mechanism in apps/home/controller/ParserController.php (parserIfLabel), which allows an attacker to inject and execute code through a c...
CVE-2018-19595: Improper Control of Generation of Code
PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current=pboot:ifevAl$GETa1/pboot:if&a=phpinfo; URI, because of an incorrect apps\home\controller\ParserController.php parserIfLabel...
PT-2018-15015
Name of the Vulnerable Software and Affected Versions PbootCMS version 1.3.1 Description The issue allows remote attackers to execute arbitrary code. This is achieved through the use of eval with mixed case in a specific URI, such as "index.php/list/5/?current=pboot:ifevAl$...
Code injection
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL generallogfile" statement, followed by a SELECT statement containing this PHP code...
CVE-2018-19053
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL generallogfile" statement, followed by a SELECT statement containing this PHP code...
CVE-2018-19053
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL generallogfile" statement, followed by a SELECT statement containing this PHP code...
CVE-2018-19053
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL generallogfile" statement, followed by a SELECT statement containing this PHP code...
CVE-2018-19053
CVE-2018-19053 affects PbootCMS 1.2.2, where a remote attacker can achieve arbitrary PHP code execution by manipulating a .php filename in a SET GLOBAL general_log_file statement, followed by a SELECT containing the code. The root cause is the combination of allowing an external input to specify ...
PbootCMS Arbitrary PHP Code Execution Vulnerability
PbootCMS is a new core open source enterprise building system developed by Avantech. An arbitrary PHP code execution vulnerability exists in PbootCMS 1.2.2. A remote attacker can exploit this vulnerability by specifying a .php file name in the "SET GLOBAL generallogfile" statement and a subsequen...
CVE-2018-19053: Improper Control of Generation of Code
PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL generallogfile" statement, followed by a SELECT statement containing this PHP code...
PbootCMS Database Backup File Has Information Leakage Vulnerability
PbootCMS is a new core open source enterprise building system developed by Avantech. There is an information leakage vulnerability in the database backup file of PbootCMS. Attackers can use the vulnerability to obtain sensitive information...
PbootCMS SQL Injection Vulnerability (CNVD-2018-21503)
PbootCMS is an open source enterprise building content management system CMS developed using the PHP language. A SQL injection vulnerability exists in the apps\admin\controller\content\SingleController.php file in PbootCMS version 1.2.2-20181012. A remote attacker can exploit this vulnerability t...
CVE-2018-18450
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...
Sql injection
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...
CVE-2018-18450
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...
CVE-2018-18450
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...
CVE-2018-18450
PbootCMS is affected by CVE-2018-18450. The vulnerability resides in apps\admin\controller\content\SingleController.php and is present in PbootCMS prior to version 1.3.0 build 2018-11-12. It is a SQL Injection flaw exploitable via a crafted POST to the admin.php/Single/mod/mcode/1/id/3 URI, as de...
CVE-2018-18450: Improper Neutralization of Special Elements used in an SQL Command
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...
PbootCMS V1.2.1 SQL Injection Vulnerability in Frontend
PbootCMS is a new core open source enterprise building system developed by Avantech. PbootCMS V1.2.1 has a SQL injection vulnerability in the frontend, which can be exploited by attackers to obtain sensitive information...