critical9.8
CVE-2021-47900
Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands throu…
Impact
Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through manipulated HTTP headers. Attackers can inject PHP code in the User-Agent header with shell_exec() to run system commands by sending crafted requests to the admin endpoint.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gila CMS | Gila CMS | before 2.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.