Description
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Openkm | OpenKM Community Edition | ≤ 6.3.12 | — |
| Openkm | OpenKM Professional Edition | ≤ 7.1.47 | — |
References
- ExploitDB-52520 exploit
- Official Product Homepage product
- Product Reference product
- Vulnerability Advisory vendor-advisory
- Proof-of-Concept Toolkit product
- Nuclei Detection Template product
- VulnCheck Advisory: OpenKM 6.3.12 Remote Code Execution via Administrative Scripting third-party-advisory