CVE-2019-7580: Code Injection
Published Feb 7, 2019
·Updated
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection.
Affected Software
1 affected component
ThinkCMF ThinkCMF=5.0.190111
Event History
Feb 7, 2019
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is CVE-2019-7580?
CVE-2019-7580 is a vulnerability in ThinkCMF 5.0.190111 that allows remote attackers to execute arbitrary PHP code.
2
How does CVE-2019-7580 work?
CVE-2019-7580 works by allowing remote attackers to inject data/conf/route.php through the mishandling of a single quote character in the portal/admin_category/addpost.html alias parameter.
3
What is the severity of CVE-2019-7580?
The severity of CVE-2019-7580 is high with a CVSS score of 8.8.
4
What software versions are affected by CVE-2019-7580?
ThinkCMF version 5.0.190111 is affected by CVE-2019-7580.
5
How can I fix CVE-2019-7580?
To fix CVE-2019-7580, update ThinkCMF to a version that is not vulnerable.