PT-2020-15168
CVE-2020-19142
·
تاريخ النشر
2020-12-10
·
تاريخ التحديث
2020-12-11
الوصف من
CVSS 2.0
10
حرجةالمقاييسAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
iCMS version 7
Description
The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the
DB PREFIX parameter to install/install.php. This enables them to potentially install malicious software or perform other unauthorized actions.Recommendations
For iCMS version 7, avoid using the
DB PREFIX parameter in the install/install.php endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the install/install.php endpoint to minimize the risk of exploitation. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾