Description
Eval injection vulnerability in ip_cms/modules/standard/content_management/actions.php in ImpressPages CMS 1.0.12 and possibly other versons before 1.0.13 allows remote attackers to execute arbitrary code via the cm_group parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | impresspages/impresspages | < 1.0.13 | 1.0.13 | GHSA-fr34-mx6j-vpxh |
References
- 46193 third-party-advisory
- http://www.impresspages.org/news/impresspages-1-0-13-security-release/
- 75783 vdb-entry
- [oss-security] 20120118 Re: CVE-request: NGS00109 remote code execution in ImpressPages CMS mailing-list
- 49798 vdb-entry
- 20120105 NGS00109 Technical Advisory: Remote Code Execution in ImpressPages CMS mailing-list
- [oss-security] 20120115 CVE-request: NGS00109 remote code execution in ImpressPages CMS mailing-list
- 20110927 NGS00109 Patch Notification: ImpressPages CMS Remote code execution mailing-list