high7.5Public exploit code
CVE-2012-5231
miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, w…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- MiniCMS 1.0/2.0 - PHP Code Injection2012-01-22 · webapps · php
Impact
miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted (1) pagename or (2) area variable containing an executable extension, which is not properly handled by (a) update.php when writing files to content/, or (b) updatenews.php when writing files to content/news/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jessgramp | Minicms | Versions 1.0, 2.0 |