CVE-2020-10389

Katalog CVE

CVSS 7.2 · High EPSS 4,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada chadhaajay phpkb. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

admin/save-settings.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by injecting PHP code into any POST parameter when saving global settings.

Rincian

Terbit di NVD

12 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

4,9% peluang dieksploitasi; lebih tinggi dari 91,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://antoniocannito.it/?p=137#rce2 exploit · advisory pihak ketiga
• http://packetstormsecurity.com/files/156751/PHPKB-Multi-Language-9-Authenticated-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://antoniocannito.it/phpkb1#authenticated-remote-code-execution-cve-2020-10389 exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/48219 exploit · advisory pihak ketiga · vdb entry