CVE-2017-14048
HighSummary
BlackCat CMS version 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. This can also be exploited via CSRF.
Risk Assessment
Exploitation of this vulnerability may lead to remote code execution, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update BlackCat CMS to the latest version and implement protections against CSRF attacks.
Other vulnerabilities in BlackCat CMS 1.2
See all- CVE-2017-14399High
In BlackCat CMS version 1.2.2, unrestricted file upload is possible in backend/media/ajax_rename.php via the extension parameter, allowing the extension to be changed from .jpg to .php.
- CVE-2017-14050High
In BlackCat CMS version 1.2, the backend/addons/install.php file allows remote authenticated users to execute arbitrary PHP code via a ZIP archive containing a .php file.
Original NVD description (English source)
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.