CVE-2018-17036

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-09-14

Last modified

2024-08-05

Weaknesses

CWE-94

Affected products

• Ucms (Ucms Project)

References

• https://github.com/blackstar24/UCMS/blob/master/phpinfo.md