CVE-2019-11376

HIGH

SOY CMS 3.0.2 - Remote Code Execution via PHP Code Injection in Text Box

Title source: manual
STIX 2.1

Description

SOY CMS v3.0.2 allows remote attackers to execute arbitrary PHP code via a <?php substring in the second text box. NOTE: the vendor indicates that there was an assumption that the content is "made editable on its own.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
http://www.iwantacve.cn/index.php/archives/212/
Exploit, Third Party Advisory x_refsource_misc
https://github.com/inunosinsi/soycms/issues/5

Scores

CVSS v3 7.2
EPSS 0.0225
EPSS Percentile 80.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (1)
brassica/soy_cms 3.0.2
Published Apr 20, 2019
Tracked Since Feb 18, 2026