CVE-2019-17370 - OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation

Back Back to CVE browser

HIGH

OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation

Published Oct 9, 2019

7.2

HIGH

CVSS 3.1

EPSS 2.07%

Description

OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation. Therefore, the attacker can create a .php file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7777
Advisory
https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7777		Advisory
https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md		x_refsource_MISCExploitThird Party Advisory