PT-2020-17032
CVE-2020-28693
·
تاريخ النشر
2020-11-16
·
تاريخ التحديث
2020-11-30
الوصف من
CVSS 2.0
9.0
عاليةالمقاييسAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
HorizontCMS version 1.0.0-beta
Description
The issue allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme. The attacker can then execute the PHP file via an HTTP GET request to /themes/.
Recommendations
For HorizontCMS version 1.0.0-beta, consider restricting access to the theme upload feature to prevent unauthorized file uploads until a patch is available. As a temporary workaround, restrict access to the /themes/ directory to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾