Critical severity · published Mar 11, 2019
CVE-2019-9651
An issue was discovered in SDCMS V1.7
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
An issue was discovered in SDCMS V1.7. In the \app\admin\controller\themecontroller.php file, the check_bad() function's filtering is not strict, resulting in PHP code execution. This occurs because some dangerous PHP functions (such as "eval") are blocked but others (such as "system") are not, and because ".php" is blocked but ".PHP" is not blocked.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Sdcms · Sdcms
1.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-9651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-9651
Exploit
http://www.iwantacve.cn/index.php/archives/155/
More from Sdcms
8.8
CVE-2019-9652
There is a CSRF in SDCMS V1.7 via an m=admin&c=theme&a=edit request
8.8
CVE-2018-19520
An issue was discovered in SDCMS 1.6 with PHP 5.x
8.8
CVE-2018-11004
An issue was discovered in SDcms v1.5
7.5
CVE-2018-19748
app/plug/attachment/controller/admincontroller.php in SDCMS 1.6 allows reading arbitrary files via a /?m=plug&c=admin&a=index&p=attachment&root= directory traversal