CVE-2012-5777 Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a cr...
MediumCVSS 6.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| phome empirecms | = 6.6 | No fix listed |
References
- 20121105 [CVE-2012-5777]EmpireCMS Template Parser Remote PHP Code Execution Vulnerability exploit mailing-list
- packetstormsecurity.com
- packetstormsecurity.org
- 56406 vdb-entry
- empirecms-template-code-execution(79779) vdb-entry