CVE-2019-9651: Code Injection

Published Mar 11, 2019

Updated

An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the checkbad() function's filtering is not strict, resulting in PHP code execution. This occurs because some dangerous PHP functions (such as "eval") are blocked but others (such as "system") are not, and because ".php" is blocked but ".PHP" is not blocked.

Affected Software

1 affected component

SDCMS SDCMS=1.7

Event History

Mar 11, 2019

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·01:29 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-9651?

CVE-2019-9651 is rated as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2019-9651?

To fix CVE-2019-9651, it is recommended to upgrade to a patched version of SDCMS that addresses the filtering issues in themecontroller.php.

What versions of SDCMS are affected by CVE-2019-9651?

CVE-2019-9651 affects SDCMS version 1.7.

What type of vulnerability is CVE-2019-9651?

CVE-2019-9651 is a remote code execution vulnerability due to improper input filtering.

Can CVE-2019-9651 be exploited remotely?

Yes, CVE-2019-9651 can be exploited remotely without authentication, allowing attackers to execute arbitrary PHP code.