First published: Fri Jun 07 2019(Updated: )
admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Phome Empire | <=7.5.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-19462 has a medium severity rating due to the potential for remote code execution through SQL injection.
To fix CVE-2018-19462, upgrade your EmpireCMS to the latest version above 7.5 to avoid SQL injection vulnerabilities.
CVE-2018-19462 is an SQL injection vulnerability that allows attackers to execute arbitrary PHP code.
EmpireCMS versions up to and including 7.5 are affected by CVE-2018-19462.
By exploiting CVE-2018-19462, attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise.