CVE-2019-7580

HIGH EXPLOITED

ThinkCMF 5.0.190111 - Remote Code Execution via Portal Admin Category Alias Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2019-7580 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admin_category/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://xz.aliyun.com/t/3997

Scores

CVSS v3 8.8
EPSS 0.0993
EPSS Percentile 95.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2023-07-05
CWE
CWE-94
Status published
Products (1)
thinkcmf/thinkcmf 5.0.190111
Published Feb 07, 2019
Tracked Since Feb 18, 2026