CVE-2018-10236
HIGHPOSCMS 3.2.18 - Remote Code Execution via Syscontroller.php Add Function
Title source: llmDescription
POSCMS 3.2.18 allows remote attackers to execute arbitrary PHP code via the diy\dayrui\controllers\admin\Syscontroller.php 'add' function because an attacker can control the value of $data['name'] with no restrictions, and this value is written to the FCPATH.$file file.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/myndtt/vulnerability/blob/master/poscms/3-2-18.md
Scores
CVSS v3
7.2
EPSS
0.0152
EPSS Percentile
71.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-94
Status
published
Products (1)
poscms/poscms
3.2.18
Published
Apr 19, 2018
Tracked Since
Feb 18, 2026