CVE-2019-7692 Code injection in n/a
Remote attackers can execute arbitrary PHP code via a crafted prefix value in the installer, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7692?
CVE-2019-7692 is a critical code injection vulnerability in n/a, published on 10 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
install/install.php in CIM 0.9.3 allows remote attackers to execute arbitrary PHP code via a crafted prefix value because of configuration file mishandling in the N=83 case, as demonstrated by a call to the PHP fputs function that creates a .php file in the public folder.
Weakness: CWE-94
Which versions are affected by CVE-2019-7692?
It affects 1 product.
Products include Cim Project Cim.
How do I fix CVE-2019-7692?
No fix has been published for CVE-2019-7692 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-7692 being exploited?
There is no known exploitation of CVE-2019-7692 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7773-cmc4-r8g7.