CVE-2018-17364 Code injection in n/a

What is CVE-2018-17364?

CVE-2018-17364 is a high-severity code injection vulnerability in n/a, published on 23 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.

Weakness: CWE-94, CWE-362

Which versions are affected by CVE-2018-17364?

It affects 1 product.

Products include Otcms Otcms.

How do I fix CVE-2018-17364?

No fix has been published for CVE-2018-17364 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-17364 being exploited?

There is no known exploitation of CVE-2018-17364 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-30637 Server-side request forgery in n/a High 7.5
• CVE-2019-17370 Code injection in n/a High 7.2
• CVE-2019-17369 Cross-site request forgery in n/a Medium 6.5
• CVE-2023-3237 OTCMS hard-coded password Medium 6.3
• CVE-2023-3238 OTCMS server-side request forgery Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8xvc-mxv2-c4gq.