Remote Code Execution in Typecho V1.1 by Unauthorized Command Injection
CVE-2018-18753

9.8CRITICAL

Key Information:

Vendor

Typecho

Status
Typecho
Vendor
CVE Published:
29 October 2018

What is CVE-2018-18753?

Typecho V1.1 is susceptible to a remote code execution vulnerability, where attackers can exploit the system by sending malicious shell commands embedded within base64-encoded serialized data. This weakness can lead to unauthorized access and manipulation of the targeted server, making it imperative for users to apply necessary security updates and configurations to protect their applications against such threats.

References

https://github.com/wuzhicms/wuzhicms/issues/157
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.