CVE-2012-5231 miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, which is not properly handled by (a) updat...
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, which is not properly handled by (a) update.php when writing files to content/, or (b) updatenews.php when writing files to content/news/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jessgramp minicms | = 1.0 | No fix listed |
| jessgramp minicms | = 2.0 | No fix listed |
References
- 18410 exploit
- 51612 exploit vdb-entry
- minicms-content-code-injection(72645) vdb-entry