CVE-2018-14579

Name of the Vulnerable Software and Affected Versions GolemCMS through 2008-12-24

Description The issue allows remote attackers to execute arbitrary PHP code by inserting this code into the Table prefix form field in the "Database Information" section, or obtain sensitive information via a direct request for install/install.sql, if the install/ directory remains active after an installation.

Recommendations For GolemCMS through 2008-12-24, remove or restrict access to the install/ directory after installation to prevent exploitation. As a temporary workaround, consider restricting access to the "Database Information" section to minimize the risk of arbitrary PHP code execution. Avoid using the Table prefix form field in the "Database Information" section until the issue is resolved.