CRITICAL🇬🇧 English

CVE-2018-18702

CVSS 9.8v3.0pub. 2018-10-29upd. 2024-11-21

spider.admincp.php in iCMS v7.0.11 allows SQL injection via admincp.php?app=spider&do=import_rule because the upfile content is base64 decoded, deserialized, and used for database insertion.

oryginał EN
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Icmsdev Icms

    APP
    Icmsdev
    7.0.11
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
SQLiDeserialization
CWE
Referencje

Powiązane podatności

CVE-2023-42322CRITICAL9.8ten sam produkt

Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive infor...

CVE-2019-6259CRITICAL9.8ten sam produkt

An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp...

CVE-2018-14514CRITICAL9.8ten sam produkt

An SSRF vulnerability was discovered in idreamsoft iCMS V7.0.9 that allows attackers to read sensitive files, ...

CVE-2018-12498CRITICAL9.8ten sam produkt

spider.admincp.php in iCMS v7.0.8 has SQL Injection via the id parameter in an app=spider&do=batch request to ...

CVE-2018-9924CRITICAL9.8ten sam produkt

An issue was discovered in idreamsoft iCMS through 7.0.7. SQL injection exists via the pid array parameter in ...