Sdcms Sdcms 1.6

CPE Details

Sdcms Sdcms 1.6
sdcms
sdcms
1.6
2018-12-19
13h44 +00:00
2021-08-12
15h23 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:sdcms:sdcms:1.6:*:*:*:*:*:*:*

Informations

Vendor

sdcms

Product

sdcms

Version

1.6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2018-19748 2018-11-29 21h00 +00:00 app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal. The value of the root parameter must be base64 encoded (note that base64 encoding, instead of URL encoding, is very rare in a directory traversal attack vector).
7.5
High
CVE-2018-19520 2018-11-25 19h00 +00:00 An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad function in an attempt to block certain PHP functions such as eval, but does not prevent use of preg_replace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.
8.8
High