PT-2020-12059
CVE-2020-10389
·
Published
2020-03-12
·
Updated
2022-04-18
Description by
CVSS 3.1
7.2
HighMetricsAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Chadha PHPKB Standard Multi-Language version 9
Description
The issue allows remote attackers to achieve code execution by injecting PHP code into any POST parameter when saving global settings.
Recommendations
For Chadha PHPKB Standard Multi-Language version 9, consider validating and sanitizing all POST parameters in the admin/save-settings.php file to prevent PHP code injection. As a temporary workaround, restrict access to the admin/save-settings.php file until a patch is available.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾