Abstin

Name of the Vulnerable Software and Affected Versions: puppyCMS version 5.1 Description: The issue allows remote malicious attackers to delete files or folders. This is achieved via the `/admin/functions.php` API endpoint. Recommendations: For puppyCMS version 5.1, as a temporary workaround, consider restricting access to the `/admin/functions.php` endpoint until a patch is available. Avoid using this endpoint for file or folder management until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: puppyCMS version 5.1 Description: A Cross Site Request Forgery (CSRF) issue allows changing the admin's password via the /admin/settings.php API endpoint. Recommendations: For puppyCMS version 5.1, consider implementing proper CSRF token validation to prevent unauthorized password changes. As a temporary workaround, restrict access to the /admin/settings.php endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** puppyCMS version 5.1 **Description** The issue is related to the implementation of the admin/functions.php script in the puppyCMS system, which is associated with incorrect permission storage. This could allow a remote attacker to execute arbitrary code. The vulnerability can be exploited via the "/admin/functions.php" API endpoint, potentially allowing a malicious user to gain shell access. **Recommendations** For puppyCMS version 5.1, consider restricting access to the /admin/functions.php endpoint until a patch is available. As a temporary workaround, review and secure the permission settings in the admin/functions.php script to prevent exploitation.