Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2019-07-18T17:23:11

Updated: 2024-08-05T00:05:44.009Z

Reserved: 2019-07-18T00:00:00

Link: CVE-2019-13956

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2019-07-18T18:15:12.437

Modified: 2024-11-21T04:25:46.623

Link: CVE-2019-13956

cve-icon Redhat

No data.