high7.2Public exploit code
CVE-2020-35754
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Quick.CMS 6.7 - Remote Code Execution (Authenticated)2021-01-29 · webapps · php
Impact
OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opensolution | Quick.Cart | before 6.7 |
| Opensolution | Quick.Cms | before 6.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html
- https://opensolution.org/cms-system-quick-cms.html
- https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html
- https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/
- http://packetstormsecurity.com/files/161189/Quick.CMS-6.7-Remote-Code-Execution.html
- https://opensolution.org/cms-system-quick-cms.html
- https://opensolution.org/security-fix-for-cart-and-cms%21-en-1136.html
- https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/