Code Injection Vulnerability in phpwcms by phpwcms GmbH
CVE-2020-21784

9.8CRITICAL

Key Information:

Vendor

PHPwcms

Status
PHPwcms
Vendor
CVE Published:
24 June 2021

What is CVE-2020-21784?

The phpwcms content management system version 1.9.13 is susceptible to a code injection vulnerability through the setup.php file located in the /phpwcms/setup/ directory. This vulnerability can potentially allow an attacker to execute arbitrary PHP code on the server, which may lead to significant security breaches. Proper input validation and sanitization measures are essential to prevent such exploits.

References

https://github.com/slackero/phpwcms/issues/286
x_refsource_MISC
https://cwe.mitre.org/data/definitions/96.html
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.