Description
A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of the component Backend App Configuration Module. The manipulation of the argument CT_App_Paytype leads to code injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CTCMS | Content Management System | 2.1.0, 2.1.1, 2.1.2 | — |
References
- VDB-336486 | CTCMS Content Management System Backend App Configuration Ct_App.php save code injection vdb-entry technical-description
- VDB-336486 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #707104 | ctcms 2.1.2 Command Injection third-party-advisory
- https://note-hxlab.wetolink.com/share/R3y6uiOuuYbA exploit