Remote Code Execution in BlackCat CMS by M4ple
CVE-2017-14050

8.8HIGH

Key Information:

Vendor

Blackcat-cms

Status
Blackcat Cms
Vendor
CVE Published:
31 August 2017

What is CVE-2017-14050?

The vulnerability in BlackCat CMS version 1.2 allows authenticated users to exploit the backend/addons/install.php file. By uploading a ZIP archive containing a .php file, attackers can execute arbitrary PHP code on the server. This could lead to unauthorized access, data manipulation, or complete compromise of the web application. Proper security measures, including validation of uploaded files and restricting user permissions, are essential to mitigate this risk.

References

https://github.com/M4ple/vulnerability/blob/master/blackc...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2017-14050 : Remote Code Execution in BlackCat CMS by M4ple