- Description
- webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.
- Source
- cve@mitre.org
- NVD status
- Modified
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- nvd@nist.gov
- CWE-20
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:flux_cms:flux_cms:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F33FBA9-26D8-44D2-8DC6-748D0CD24A39",
"versionEndIncluding": "1.50"
},
{
"criteria": "cpe:2.3:a:flux_cms:flux_cms:1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F208450A-A587-41FA-8A8D-000C4CDD4C76"
},
{
"criteria": "cpe:2.3:a:flux_cms:flux_cms:1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3E60F331-132D-4EAE-8998-6ABCC4B7906B"
},
{
"criteria": "cpe:2.3:a:flux_cms:flux_cms:1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D77F330E-E841-421C-91C7-734BDF833ED4"
},
{
"criteria": "cpe:2.3:a:flux_cms:flux_cms:1.31:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A408092F-B14B-4B8A-B3ED-A533A81EF2E1"
}
],
"operator": "OR"
}
]
}
]