CTCMS vulnerabilities

In CTCMS Content Management System up to version 2.1.2, there is a vulnerability in the template management module (CT_Parser.php). Improper neutralization of special elements in the template engine allows remote attacks.

A code injection vulnerability has been discovered in CTCMS Content Management System up to version 2.1.2, affecting an unknown function in the /ctcms/libs/Ct_Config.php library within the Backend System Configuration Module. Manipulating the Cj_Add/Cj_Edit arguments allows remote code execution. The exploit is publicly available.

A code injection vulnerability has been identified in CTCMS Content Management System up to version 2.1.2, affecting the Save function in the /ctcms/libs/Ct_App.php file within the Backend App Configuration Module. Manipulating the CT_App_Paytype argument allows remote code execution. The exploit is publicly available.