CVE-2010-0988
Pulse CMS < 1.2.3 - Unauthenticated Arbitrary File Write and Remote Code Execution via Login Failure Handling
Title source: llmDescription
Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote authenticated users to write to arbitrary files and execute arbitrary PHP code via vectors involving the (2) filename and (3) block parameters to view.php.
References (8)
Core 8
Core References
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/510300/100/0/threaded
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2010-45/
Vendor Advisory x_refsource_misc
http://secunia.com/secunia_research/2010-51/
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/63168
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/38956
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://www.osvdb.org/63166
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/510299/100/0/threaded
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39011
Scores
EPSS
0.0118
EPSS Percentile
63.8%
Details
CWE
CWE-94
Status
published
Products (10)
pulsecms/pulse_cms
1.0
pulsecms/pulse_cms
1.1
pulsecms/pulse_cms
1.01
pulsecms/pulse_cms
1.2
pulsecms/pulse_cms
1.2.1
pulsecms/pulse_cms
1.15
pulsecms/pulse_cms
1.16
pulsecms/pulse_cms
1.17
pulsecms/pulse_cms
1.18
pulsecms/pulse_cms
< 1.2.2
Published
Mar 26, 2010
Tracked Since
Feb 18, 2026