CVE-2018-19180

statics/app/index/controller/Install.php in YUNUCMS 1.1.5 (if install.lock is not present) allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DB_PREFIX field, which is written to database.php.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

1.51% chance of exploitation in the next 30 days, 73th percentile

Published

2018-11-11

Updated

2024-09-16

Proof-of-concept exploits (1)

• doublefast/yunucms/issues/1

References

• CVE Record
• NVD entry

Related

• CVE-2018-19181
• CVE-2018-19178
• CVE-2018-19150
• CVE-2018-19186
• CVE-2018-19145
• CVE-2018-19187