CVE-2021-36424: Code Injection
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-36424?
CVE-2021-36424 is a vulnerability discovered in phpwcms 1.9.25 that allows remote attackers to run arbitrary code via the DB user field during installation.
How severe is CVE-2021-36424?
CVE-2021-36424 has a severity rating of 9.8 out of 10, making it a critical vulnerability.
How can the CVE-2021-36424 vulnerability be exploited?
The CVE-2021-36424 vulnerability can be exploited by remote attackers who can manipulate the DB user field during installation to execute arbitrary code.
Is there a fix for CVE-2021-36424?
Yes, upgrading phpwcms to version 1.9.26 or later will fix the CVE-2021-36424 vulnerability.
Where can I find more information about CVE-2021-36424?
You can find more information about CVE-2021-36424 at the following reference: [https://github.com/slackero/phpwcms/issues/310](https://github.com/slackero/phpwcms/issues/310)