PT-2017-13224
CVE-2017-14050
·
تاريخ النشر
2017-08-31
·
تاريخ التحديث
2017-09-01
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
BlackCat CMS version 1.2
Description
The issue allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file. This is possible through the backend/addons/install.php endpoint.
Recommendations
For BlackCat CMS version 1.2, consider restricting access to the
install.php file in the backend/addons directory to prevent exploitation until a patch is available. Avoid using the install.php file to install addons from untrusted sources. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾