46 matches found
PHPCMS 2008 - Remote Code Execution via Template Injection
PHPCMS 2008 suffers from an unauthenticated RCE via template injection in type.php, where attacker-supplied content is written into a PHP template cache file, which is then executable. id: CVE-2018-19127 info: name: PHPCMS 2008 - Remote Code Execution via Template Injection author: tomaquet18...
phpcms-2008-CVE-2018-19127
phpcms-2008-CVE-2018-19127 最近、phpcms 2008 のソースコードの /type.php に脆弱性を発見しました。攻撃者が「/type.php?template=tag;@unlinkFILE;assert$POST1;//../rss」のような細工されたリクエストを送信すると、悪意のあるコンテンツ（この場合は「@unlinkFILE;assert$POST1;」）がキャッシュファイル（この場合は「/cachetemplate/rss.tpl.php」）に書き込まれます。 /type.php には以下のコードがあります： ifempty$template...
EUVD-2011-0663
Malware in sbrugna...
EUVD-2011-0662
Malware in sbrugna...
EUVD-2020-14968
Malware in sbrugna...
CVE-2020-22203
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php...
CVE-2020-22203
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php...
Sql injection
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php...
Design/Logic Flaw
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php...
CVE-2020-22203
SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php...
CVE-2020-22201
In the provided documents, the affected software is phpcMS 2008 sp4. The vulnerability arises in the yp/product.php endpoint, where the pagesize parameter can be exploited by remote malicious users to execute arbitrary PHP commands (command injection). The root cause is improper handling of the p...
CVE-2020-22201
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php...
PHPCMS 2008 type.php Code Injection (CVE-2018-19127)
A code injection vulnerability exists in PHPCMS 2008. An attacker could write arbitrary content to a website cache file with a controllable filename. Successful exploitation of this vulnerability could lead to arbitrary code execution...
CVE-2018-19127
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cachetemplate/.tpl.php file...
Code injection
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cachetemplate/.tpl.php file...
CVE-2018-19127
PHPCMS 2008 is vulnerable to unauthenticated remote code execution (RCE) via a code injection flaw in the /type.php file. Attackers can exploit the 'template' parameter to write arbitrary content into a website cache file with a controllable filename, specifically within data/cache_template/*.tpl...
PHPCMS 2008 /preview.php SQL注入漏洞
No description provided by source...
PHPCMS 2008 c.php SQL注入漏洞
No description provided by source...