PT-2017-14636
CVE-2017-16920
·
تاريخ النشر
2017-11-21
·
تاريخ التحديث
2019-10-03
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
FineCms version 5.2.0
Description
The issue allows remote attackers to upload arbitrary .php files. This is possible due to a default SYS KEY value in the v5/config/system.php file, which does not require key regeneration for each installation. Attackers can exploit this via a member API swfupload action to index.php.
Recommendations
For FineCms version 5.2.0, consider regenerating the SYS KEY value for each installation to prevent the use of a default key, and restrict access to the swfupload action in index.php to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾