high8.8
CVE-2020-24036
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
Impact
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fork-Cms | Fork Cms | before 5.8.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161764/ForkCMS-PHP-Object-Injection.html
- http://seclists.org/fulldisclosure/2021/Mar/31
- https://tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036
- https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04
- http://seclists.org/fulldisclosure/2021/Mar/31
- https://tech.feedyourhead.at/content/ForkCMS-PHP-Object-Injection-CVE-2020-24036
- https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories/ait-sa-20210215-04