CVE-2018-11670

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603

Description A CSRF issue allows attackers to execute arbitrary PHP code via the content parameter to "index.php?m=admin&c=media&a=fileconnect" API endpoint.

Recommendations For GreenCMS version 2.3.0603, as a temporary workaround, consider restricting access to the "index.php?m=admin&c=media&a=fileconnect" API endpoint until a patch is available. Avoid using the content parameter in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.