CVE-2018-16343

HIGH 7.2EPSS 2.7%

SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.

CVSS v3.0: 7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0: 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS: 2.70% chance of exploitation in the next 30 days, 85th percentile
Published: 2018-09-02
Updated: 2024-08-05

Proof-of-concept exploits (1)

cumtxujiabin/CmsPoc/blob/master/Seacms_v6.61_backend_RCE.md

References

Related