Design/Logic Flaw

2019-02-0717:29:00

PRIOn knowledge base

www.prio-n.com

9.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.0%

JSON

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.

CPENameOperatorVersion
thinkcmfeq5.0.190111

CPE	Name	Operator	Version
	thinkcmf	eq	5.0.190111

References

github.com/shadowsock5/ThinkCMF-5.0.190111/blob/master/README.md

xz.aliyun.com/t/3997