CVE-2020-19142: OS Command Injection
Published Dec 10, 2020
·Updated
iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DBPREFIX parameter to install/install.php.
Affected Software
1 affected component
idreamsoft iCMS=7.0.0
Event History
Dec 10, 2020
CVE Published
via MITRE·09:07 PM
Data Sourced
via MITRE·09:07 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-19142?
The severity of CVE-2020-19142 is critical with a CVSS score of 9.8.
2
How can attackers exploit CVE-2020-19142?
Attackers can exploit CVE-2020-19142 by executing arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php.
3
Which version of iCMS is affected by CVE-2020-19142?
iCMS version 7.0.0 is affected by CVE-2020-19142.
4
Is there a fix available for CVE-2020-19142?
At the moment, there is no known fix for CVE-2020-19142. It is recommended to update to a patched version when available.
5
Where can I find more information about CVE-2020-19142?
You can find more information about CVE-2020-19142 at the following link: [https://github.com/idreamsoft/iCMS/issues/65](https://github.com/idreamsoft/iCMS/issues/65)