CVE-2023-5221 ForU CMS index.php code injection
Remote attackers can execute arbitrary code via the db_name argument in the installation script of ForU CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5221?
CVE-2023-5221 is a medium-severity code injection vulnerability in ForU CMS, published on 27 Sep 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability classified as critical has been found in ForU CMS. This affects an unknown part of the file /install/index.php. The manipulation of the argument db_name leads to code injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The associated identifier of this vulnerability is VDB-240363. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-94
Which versions are affected by CVE-2023-5221?
It affects 1 product.
Products include Foru Cms Project Foru Cms.
How do I fix CVE-2023-5221?
No fix has been published for CVE-2023-5221 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-5221 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5221 exists.
Other vulnerabilities in ForU CMS
Sources
Also known as GHSA-qvr3-gchp-26j6.