CVE Catalog
CVE-2017-10968
CriticalSummary
A vulnerability in FineCMS up to July 7, 2017 allows remote PHP code execution by placing code after "<?php" in a route=template request.
Risk Assessment
An attacker can fully compromise the server by executing arbitrary PHP code, leading to loss of confidentiality, integrity, and availability of data.
Recommendation
Immediately update FineCMS to the latest available version or apply a security patch to prevent code injection in the route parameter.
Original NVD description (English source)
In FineCMS through 2017-07-07, application\core\controller\template.php allows remote PHP code execution by placing the code after "<?php" in a route=template request.