CVE-2020-36037 Code injection in n/a
Remote attackers can execute arbitrary code in wuzhicms via the setting parameter in the ueditor component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36037?
CVE-2020-36037 is a high-severity code injection vulnerability in Wuzhicms Wuzhicms, published on 11 Aug 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was disocvered in wuzhicms version 4.1.0, allows remote attackers to execte arbitrary code via the setting parameter to the ueditor in index.php.
Which versions are affected by CVE-2020-36037?
It affects 1 product.
Products include Wuzhicms Wuzhicms.
How do I fix CVE-2020-36037?
No fix has been published for CVE-2020-36037 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-36037 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-36037 exists.
Other vulnerabilities in Wuzhicms Wuzhicms
Sources
Also known as GHSA-658x-hxq7-f72p.