CVE-2017-9771
CriticalSummary
The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.
Risk Assessment
Attackers can exploit this vulnerability to gain control over the system, potentially leading to data loss or compromise of the entire application.
Recommendation
It is recommended to update to the latest version of WebsiteBaker and to verify and secure configuration parameters against unauthorized access.
Other vulnerabilities in WebsiteBaker v2.10.0
See all- CVE-2021-47788High
WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code. Attackers can exploit the language installation endpoint by manipulating language installation parameters to achieve remote code execution on the server.
- CVE-2014-9242High
CVE-2014-9242 is an SQL injection vulnerability in admin/pages/modify.php in WebsiteBaker 2.8.3 that allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
- CVE-2017-9360Critical
WebsiteBaker v2.10.0 has a SQL injection vulnerability in /account/details.php.
Original NVD description (English source)
install\save.php in WebsiteBaker v2.10.0 allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameter.