CVE-2018-10235
HIGHPOSCMS 3.2.10 - Remote Code Execution via Setting.php Index Function
Title source: llmDescription
POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache['setting']['ucssocfg'] in diy\module\member\models\Member_model.php and write this code into the api/ucsso/config.php file.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-10.md
Scores
CVSS v3
7.2
EPSS
0.0152
EPSS Percentile
71.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-94
Status
published
Products (1)
poscms/poscms
3.2.10
Published
Apr 19, 2018
Tracked Since
Feb 18, 2026