PT-2019-18279
CVE-2019-6713
·
تاريخ النشر
2019-01-23
·
تاريخ التحديث
2019-04-12
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
ThinkCMF version 5.0.190111
Description
The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using specific vectors involving the portal/List/index and list/:id endpoints to inject code into the data/conf/route.php file. For example, this can be demonstrated by a
file put contents call.Recommendations
For ThinkCMF version 5.0.190111, consider restricting access to the
portal/List/index and list/:id endpoints until a patch is available. As a temporary workaround, avoid using the file put contents function in the RouteController.php file to prevent code injection. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾