CVE-2017-14050
HighSummary
In BlackCat CMS version 1.2, the backend/addons/install.php file allows remote authenticated users to execute arbitrary PHP code via a ZIP archive containing a .php file.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious threat to the integrity and security of the system.
Recommendation
It is recommended to update BlackCat CMS to the latest version and restrict access to installation functions to trusted users.
Other vulnerabilities in BlackCat CMS 1.2
See all- CVE-2017-14399High
In BlackCat CMS version 1.2.2, unrestricted file upload is possible in backend/media/ajax_rename.php via the extension parameter, allowing the extension to be changed from .jpg to .php.
- CVE-2017-14048High
BlackCat CMS version 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. This can also be exploited via CSRF.
Original NVD description (English source)
In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file.