CVE-2014-9185 Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.
MediumCVSS 6.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| morfy cms project morfy cms | <= 1.04 | No fix listed |
References
- packetstormsecurity.com exploit
- 20141217 Morfy CMS v1.05 - Command Execution Vulnerability exploit mailing-list
- 20141217 Morfy CMS v1.05 - Command Execution Vulnerability mailing-list
- www.vulnerability-lab.com exploit
- github.com