CVE-2017-14048: CSRF
Published Aug 31, 2017
·Updated
BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF.
Affected Software
1 affected component
Blackcat-cms Blackcat Cms=1.2
Event History
Aug 31, 2017
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-14048?
CVE-2017-14048 is considered a critical vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2017-14048?
To mitigate CVE-2017-14048, it is recommended to update BlackCat CMS to the latest version or implement proper input validation and CSRF protections.
3
Who is affected by CVE-2017-14048?
All users of BlackCat CMS version 1.2 are affected by CVE-2017-14048.
4
What type of attack does CVE-2017-14048 enable?
CVE-2017-14048 enables attackers to inject arbitrary PHP code via a CSRF exploit.
5
When was CVE-2017-14048 published?
CVE-2017-14048 was published on October 23, 2017.