high7.5Public exploit code
CVE-2012-1200
Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Nova CMS - '/includes/function/usertpl.php?conf[blockfile]' Remote File Inclusion2012-02-11 · webapps · php · Verified
- Nova CMS - '/includes/function/gets.php?Filename' Remote File Inclusion2012-02-11 · webapps · php · Verified
- Nova CMS - '/optimizer/index.php?fileType' Remote File Inclusion2012-02-11 · webapps · php · Verified
- Nova CMS - '/administrator/modules/moduleslist.php?id' Remote File Inclusion2012-02-11 · webapps · php · Verified
Impact
Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nova-Cms | Nova Cms | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.org/files/109669/Nova-CMS-Remote-File-Inclusion.html
- http://www.securityfocus.com/bid/51976
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73159
- http://packetstormsecurity.org/files/109669/Nova-CMS-Remote-File-Inclusion.html
- http://www.securityfocus.com/bid/51976
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73159