critical9.8
CVE-2018-16975
Elefant CMS PHP Code Execution Vulnerability
Impact
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in `/designer/add/stylesheet.php` by using a `.php` extension in the New Stylesheet Name field in conjunction with `<?php` content, because of insufficient input validation in `apps/designer/handlers/csspreview.php`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | elefant/cms | < 2.0.7 | 2.0.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elefantcms | Elefant | before 2.0.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jbroadway/elefant/commit/0795ab57c7ffa53ff4af57e229f6d9680fa54a21
- https://github.com/jbroadway/elefant/issues/286
- https://github.com/jbroadway/elefant/releases/tag/elefant_2_0_7_stable
- https://github.com/advisories/GHSA-x2w2-qgv6-8xrm
- https://nvd.nist.gov/vuln/detail/CVE-2018-16975