An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The maintainer states that this is not a vulnerability but a feature used in conjunction with External Modules
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
http://www.iwantacve.cn/index.php/archives/116/ |
History
Fri, 15 Nov 2024 16:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2019-02-23T18:00:00
Updated: 2024-11-15T15:17:04.154Z
Reserved: 2019-02-23T00:00:00
Link: CVE-2019-9042
Vulnrichment
Updated: 2024-08-04T21:38:46.304Z
NVD
Status : Modified
Published: 2019-02-23T18:29:00.347
Modified: 2024-11-21T04:50:52.670
Link: CVE-2019-9042
Redhat
No data.