CVE-2018-19127
Last modified
CVE-2018-19127 is a vulnerability of currently unknown severity. A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.. EPSS estimates a 20.77% chance of exploitation in the next 30 days.
Description
A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Phpcms | Phpcms | 2008 |
References
- https://github.com/ab1gale/phpcms-2008-CVE-2018-19127Third Party Advisory
- https://github.com/ab1gale/phpcms-2008-CVE-2018-19127Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-19127?
How severe is CVE-2018-19127?
How do I fix CVE-2018-19127?
Are you affected by CVE-2018-19127?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST