| Titel | ctcms 2.1.2 Command Injection |
|---|
| Beschreibung | CTCMS (Ctcms video system) version 2.1.2 contains a command execution vulnerability in the backend APP configuration module. An authenticated administrator can modify the APP configuration to inject malicious code, leading to remote code execution.The vulnerability exists in the template parsing mechanism. When users post content in the community section, the system processes template syntax (such as `{if:...}...{end if}`) without proper sanitization. By injecting malicious template code containing PHP functions like `eval()`, an attacker can achieve remote code execution. |
|---|
| Quelle | ⚠️ https://note-hxlab.wetolink.com/share/R3y6uiOuuYbA |
|---|
| Benutzer | airrudder (UID 25092) |
|---|
| Einreichung | 05.12.2025 08:52 (vor 6 Monaten) |
|---|
| Moderieren | 15.12.2025 18:02 (10 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 336486 [CTCMS Content Management System bis 2.1.2 Backend App Configuration /ctcms/libs/Ct_App.php save CT_App_Paytype erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|