CVE-2014-1683 The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary c...
MediumCVSS 6.8
EPSS 31.4%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| skybluecanvas | <= 1.1_r248-03 | No fix listed |
References
- packetstormsecurity.com
- 20140123 Remote Command Injection Vulnerability in SkyBlueCanvas CMS mailing-list
- 56646 third-party-advisory
- 31183 exploit
- 31432 exploit
- 65129 vdb-entry
- skybluecanvas-index-command-exec(90670) vdb-entry