CVE-2020-19142

Name of the Vulnerable Software and Affected Versions iCMS version 7

Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB PREFIX parameter to install/install.php. This enables them to potentially install malicious software or perform other unauthorized actions.

Recommendations For iCMS version 7, avoid using the DB PREFIX parameter in the install/install.php endpoint until the issue is resolved. As a temporary workaround, consider restricting access to the install/install.php endpoint to minimize the risk of exploitation.