libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element within info[content] JSON data to the index.php?m=member&c=index&a=register URI.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
http://www.an-sheng.cc/index.php/archives/4/ |
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2018-07-19T05:00:00
Updated: 2024-08-05T09:29:51.065Z
Reserved: 2018-07-18T00:00:00
Link: CVE-2018-14399
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-07-19T05:29:00.350
Modified: 2024-11-21T03:48:59.600
Link: CVE-2018-14399
Redhat
No data.