CVE-2024-0728 - ForU CMS channel.php file inclusion

Back Back to CVE browser

CRITICAL

ForU CMS channel.php file inclusion

Published Jan 19, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.73%

Description

A vulnerability classified as problematic was found in ForU CMS up to 2020-06-23. Affected by this vulnerability is an unknown functionality of the file channel.php. The manipulation of the argument c_cmodel leads to file inclusion. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-251551.

Affected products

Vendor ForU Product CMS Default
n/a
- Version
  2020-06-23
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ForU

CMS

n/a

Version	Status	Constraints
2020-06-23	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-610

CWE-73

References (3)

https://github.com/mi2acle/forucmsvuln/blob/master/LFI.md
exploit
https://vuldb.com/?ctiid.251551
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.251551
vdb-entrytechnical-descriptionPermissions Required

Link	Providers	Tags
https://github.com/mi2acle/forucmsvuln/blob/master/LFI.md		exploit
https://vuldb.com/?ctiid.251551		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.251551		vdb-entrytechnical-descriptionPermissions Required