EUVD-2018-2311

Malware in sbrugna...

Arbitrary file deletion

POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data'name' with no restrictions, and this value is written to the FCPATH.$file file...

PT-2018-9776

Name of the Vulnerable Software and Affected Versions: POSCMS version 3.2.18 Description: The issue allows remote attackers to execute arbitrary PHP code. This is possible because an attacker can control the value of name with no restrictions in the add function of the Syscontroller.php file, and...

CVE-2018-10236: Improper Control of Generation of Code

POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data'name' with no restrictions, and this value is written to the FCPATH.$file file...