CVE-2017-14048 BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via....
HighCVSS 8.8
EPSS 0.55%
- Published
- Updated
- Exploit status
- No public exploit known
Description
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| blackcat-cms blackcat cms | = 1.2 | No fix listed |
References
- github.com issue-tracking third-party-advisory