CVE-2020-11803

HIGH

Titanhq Spamtitan - Code Injection

Title source: rule

Description

An issue was discovered in Titan SpamTitan 7.07. Improper sanitization of the parameter jaction when interacting with the page mailqueue.php could lead to PHP code evaluation server-side, because the user-provided input is passed directly to the php eval() function. The user has to be authenticated on the web platform before interacting with the page.

Exploits (1)

exploitdb WORKING POC
pythonwebappsmultiple
https://www.exploit-db.com/exploits/48817

References (5)

Scores

CVSS v3 8.8
EPSS 0.0872
EPSS Percentile 92.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (1)
titanhq/spamtitan 7.07
Published Sep 17, 2020
Tracked Since Feb 18, 2026