CVE-2020-37186
CRITICALChevereto 3.13.4 - Remote Code Execution via Database Table Prefix Manipulation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-37186. PoCs published by Jinny Ramsmark.
AI-analyzed exploit summary This exploit targets Chevereto (Free and Core versions) by injecting malicious PHP code into the database table prefix during installation, leading to remote code execution. It leverages file write operations to create a backdoor in 'images/license.php' and executes arbitrary commands via HTTP POST requests.
Description
Chevereto 3.13.4 Core contains a remote code execution vulnerability that allows attackers to inject malicious code during database configuration installation. Attackers can manipulate the database table prefix parameter to write a PHP shell file and execute arbitrary system commands through a crafted POST request.
Exploits (1)
This exploit targets Chevereto (Free and Core versions) by injecting malicious PHP code into the database table prefix during installation, leading to remote code execution. It leverages file write operations to create a backdoor in 'images/license.php' and executes arbitrary commands via HTTP POST requests.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H