CVE-2018-19520: Code Injection
An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a checkbad function in an attempt to block certain PHP functions such as eval, but does not prevent use of pregreplace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19520?
CVE-2018-19520 is categorized as a critical vulnerability due to its potential to allow arbitrary code execution.
How do I fix CVE-2018-19520?
To fix CVE-2018-19520, ensure you upgrade SDCMS to a newer version that addresses this vulnerability and avoid using PHP 5.x.
What software is affected by CVE-2018-19520?
CVE-2018-19520 affects SDCMS version 1.6 running on PHP versions from 5.0.0 to 5.6.38.
Can CVE-2018-19520 be exploited remotely?
Yes, CVE-2018-19520 can be exploited remotely if an attacker has access to the administrative interface of the affected SDCMS application.
What types of attacks can CVE-2018-19520 facilitate?
CVE-2018-19520 can facilitate arbitrary code execution attacks, allowing attackers to execute malicious code on the server.