Description
Eval injection vulnerability in the ReplaceListVars function in the template parser in e/class/connect.php in EmpireCMS 6.6 allows user-assisted remote attackers to execute arbitrary PHP code via a crafted template.
References
- http://packetstormsecurity.org/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html
- empirecms-template-code-execution(79779) vdb-entry
- 56406 vdb-entry
- 20121105 [CVE-2012-5777]EmpireCMS Template Parser Remote PHP Code Execution Vulnerability mailing-list
- http://packetstormsecurity.com/files/117902/EmpireCMS-6.6-PHP-Code-Execution.html