| Titel | ctcms 2.1.2 Command Injection |
|---|
| Beschreibung | CTCMS (Ctcms video system) version 2.1.2 contains a remote code execution vulnerability in the frontend community/forum functionality. An unauthenticated or low-privileged user can post malicious template syntax in the community section, leading to remote code execution when the post is viewed.The vulnerability exists in the template parsing mechanism. When users post content in the community section, the system processes template syntax (such as {if:...}...{end if}) without proper sanitization. By injecting malicious template code containing PHP functions like eval(), an attacker can achieve remote code execution. |
|---|
| Quelle | ⚠️ https://note-hxlab.wetolink.com/share/U6cnRoRfn09r |
|---|
| Benutzer | airrudder (UID 25092) |
|---|
| Einreichung | 05.12.2025 09:01 (vor 6 Monaten) |
|---|
| Moderieren | 15.12.2025 18:02 (10 days later) |
|---|
| Status | Duplikat |
|---|
| VulDB Eintrag | 336488 [CTCMS Content Management System bis 2.1.2 Frontend/Template Management CT_Parser.php erweiterte Rechte] |
|---|
| Punkte | 0 |
|---|