CVEvulnerability
CVE-2014-1683
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-01-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-134
Description
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Affected configurations
• skybluecanvas skybluecanvas (<= 1.1 r248-03)
Related
Weakness · CWE (1)
- CWE-134 Use of Externally-Controlled Format String weakness
References
- http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Jan/159 seclists.org
- http://secunia.com/advisories/56646 secunia.com
- http://www.exploit-db.com/exploits/31183 www.exploit-db.com
- http://www.exploit-db.com/exploits/31432 www.exploit-db.com
- http://www.securityfocus.com/bid/65129 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90670 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2014/Jan/159 seclists.org
- http://secunia.com/advisories/56646 secunia.com
- http://www.exploit-db.com/exploits/31183 www.exploit-db.com
- http://www.exploit-db.com/exploits/31432 www.exploit-db.com
- http://www.securityfocus.com/bid/65129 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90670 exchange.xforce.ibmcloud.com