critical9.8
CVE-2018-17036
An issue was discovered in UCMS 1.4.6 and 1.6.
Impact
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ucms Project | Ucms | Versions 1.4.6, 1.6 |