CVE-2019-6713: Code Injection
Published Jan 23, 2019
·Updated
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call.
Affected Software
1 affected component
ThinkCMF ThinkCMF=5.0.190111
Event History
Jan 23, 2019
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2019-6713?
CVE-2019-6713 has a critical severity rating as it allows remote code execution.
2
How can I fix CVE-2019-6713?
To fix CVE-2019-6713, it is recommended to upgrade to a patched version of ThinkCMF beyond 5.0.190111.
3
What type of attack does CVE-2019-6713 facilitate?
CVE-2019-6713 facilitates remote code execution attacks allowing attackers to run arbitrary PHP code.
4
Which versions of ThinkCMF are affected by CVE-2019-6713?
CVE-2019-6713 affects ThinkCMF version 5.0.190111.
5
What files are involved in the exploit of CVE-2019-6713?
The exploit of CVE-2019-6713 involves the portal/List/index and list/:id endpoints to manipulate data\conf\route.php.