| शीर्षक | sanluan PublicCMS V4.0.202506.a, V4.0.202506.b, V5.202506.a, V5.202506.b, V5.202506.d, V6.202506.d Code Injection |
|---|
| विवरण | PublicCMS versions V4.0, V5 (through V5.202506.d), and V6 (through V6.202506.d) are vulnerable to a Server-Side Template Injection (SSTI) that leads to Remote Code Execution (RCE). The AbstractFreemarkerView.doRender() method does not sanitize the Application (ServletContext) variable exposed to FreeMarker templates. An authenticated admin user can access the Spring ApplicationContext via Application["org.springframework.web.context.WebApplicationContext.ROOT"], retrieve the FreeMarker Configuration object, disable the new_builtin_class_resolver security restriction at runtime, and execute arbitrary operating system commands via freemarker.template.utility.Execute. A secondary bypass path exists through HttpRequestHashModel.get(), which passes request.getAttribute() calls without filtering, allowing access to the ApplicationContext via Spring DispatcherServlet internal attributes. |
|---|
| स्रोत | ⚠️ https://github.com/sanluan/PublicCMS/issues/113 |
|---|
| उपयोगकर्ता | anch0r (UID 96691) |
|---|
| सबमिशन | 29/03/2026 02:11 PM (6 महीनों पहले) |
|---|
| संयम | 09/04/2026 02:27 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 356541 [Sanluan PublicCMS तक 6.202506.d FreeMarker Template AbstractFreemarkerView.java AbstractFreemarkerView.doRender अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|