CVE-2014-1683

Published Jan 29, 2014

Last updated 7 years ago

Overview

Description: The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-134

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:skybluecanvas:skybluecanvas:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F7522B37-C72C-45B7-94B0-31A19AA371EF",
            "versionEndIncluding": "1.1_r248-03"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References