CVE-2018-17827

HisiPHP 1.0.8 allows remote attackers to execute arbitrary PHP code by editing a plugin's name to contain that code. This name is then injected into app/admin/model/AdminPlugins.php.

Score

CVSS 3.0 7.2 High

Status

Modified - cve@mitre.org

Published

2018-10-01

Last modified

2024-08-05

Weaknesses

CWE-94

Affected products

• Hisiphp (Hisiphp)

References

• https://github.com/rakjong/vuln/blob/master/hisiphp_hetshell_2.pdf