Critical severity · published Nov 20, 2017
CVE-2017-16903
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the…
9.8
CVSS
2%
EPSS
No
On KEV
Description
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LV
Lvyecms · Lvyecms Project
through 3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-16903
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-16903
Exploit
https://github.com/SQYY/CVE/blob/master/Lvyecms_G.txt
More from Lvyecms
6.1
CVE-2017-16904
The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator