ImpressPages CMS 'manage()' Function Arbitrary PHP Code Execution Vulnerability
BID:63507
Info
ImpressPages CMS 'manage()' Function Arbitrary PHP Code Execution Vulnerability
| Bugtraq ID: | 63507 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 01 2013 12:00AM |
| Updated: | Nov 01 2013 12:00AM |
| Credit: | Gjoko Krstic |
| Vulnerable: |
ImpressPages ImpressPages CMS 3.6 ImpressPages ImpressPages CMS 3.5 ImpressPages ImpressPages CMS 3.1 |
| Not Vulnerable: |
ImpressPages ImpressPages CMS 3.7 |
Discussion
ImpressPages CMS 'manage()' Function Arbitrary PHP Code Execution Vulnerability
ImpressPages CMS is prone to an arbitrary PHP code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server.
ImpressPages CMS 3.6, 3.5 and 3.1 are vulnerable; other versions may also be affected.
ImpressPages CMS is prone to an arbitrary PHP code-execution vulnerability.
An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server.
ImpressPages CMS 3.6, 3.5 and 3.1 are vulnerable; other versions may also be affected.
Exploit / POC
ImpressPages CMS 'manage()' Function Arbitrary PHP Code Execution Vulnerability
The following exploit is available:
The following exploit is available:
Solution / Fix
ImpressPages CMS 'manage()' Function Arbitrary PHP Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
ImpressPages CMS 'manage()' Function Arbitrary PHP Code Execution Vulnerability
References:
References:
- ImpressPages CMS Homepage (Apro Media)
- ImpressPages CMS v3.6 manage() Function Remote Code Execution Exploit (Zero Science Lab)