critical9.8Public exploit code
CVE-2023-29689
PyroCMS remote code execution vulnerability
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)2023-08-08 · webapps · python
Impact
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on the affected system.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | pyrocms/pyrocms | <= 3.9 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pyrocms | Pyrocms | Version 3.9 |