PT-2007-4648 · Powl · Powl
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Powl version 0.94
Description
The issue allows remote attackers to execute arbitrary PHP code via a URL in the
POWL[installPath] parameter in the htmledit.php file, which is part of the plugins/widgets/htmledit directory.Recommendations
For Powl version 0.94, consider restricting access to the
htmledit.php file until a patch is available, and avoid using the POWL[installPath] parameter in the affected endpoint.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Powl