| शीर्षक | Boyun Boyun PHPCMS <=1.4.20 Pre-Auth config injection |
|---|
| विवरण | A critical remote code execution (RCE) vulnerability exists in install/install_ok.php of Boyun Web CMS (≤1.4.20), where user-supplied database credentials—such as the database password—are directly written to the configuration file without proper sanitization. By injecting malicious PHP code into the database password field during installation, an attacker can cause the application to write executable code into application/database.php, which will be executed on subsequent requests, leading to full server compromise. |
|---|
| स्रोत | ⚠️ https://note-hxlab.wetolink.com/share/6wemW8CnOMbu |
|---|
| उपयोगकर्ता | YELEIPENG (UID 73615) |
|---|
| सबमिशन | 26/06/2025 05:30 AM (1 वर्ष पहले) |
|---|
| संयम | 05/07/2025 07:39 PM (10 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 315015 [BoyunCMS तक 1.4.20 Configuration File /install/install_ok.php db_pass अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|