An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The maintainer states that this is not a vulnerability but a feature used in conjunction with External Modules
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
http://www.iwantacve.cn/index.php/archives/116/ |
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2019-02-23T18:00:00
Updated: 2024-08-04T21:38:46.304Z
Reserved: 2019-02-23T00:00:00
Link: CVE-2019-9042
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-02-23T18:29:00.347
Modified: 2024-08-04T22:15:30.917
Link: CVE-2019-9042
Redhat
No data.