Remote Code Execution Vulnerability in ThinkCMF 5.0.190111 by ThinkCMF
CVE-2019-7580

8.8HIGH

Key Information:

Vendor

Thinkcmf

Status
Thinkcmf
Vendor
CVE Published:
7 February 2019

What is CVE-2019-7580?

A vulnerability in ThinkCMF version 5.0.190111 allows remote attackers to execute arbitrary PHP code. This arises from improper handling of a single quote character in the alias parameter of portal/admin_category/addpost.html. As a result, it enables attackers to inject malicious code into data/conf/route.php, which could lead to severe security breaches if exploited.

References

https://xz.aliyun.com/t/3997
x_refsource_MISC
https://github.com/shadowsock5/ThinkCMF-5.0.190111/blob/m...
x_refsource_MISC

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.