GitHub Advisoryadvisory · Packagist

GHSA-jxg9-2ch7-f552 Feehi CMS arbitrary code execution via crafted PHP file

HIGH Published 2022-07-28 Modified 2022-08-06 Official page ↗
Aliases
CVE-2022-34971
Ecosystem
Packagist
Packages
feehi/cms
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2022-08-06

Affected packages

• Packagist feehi/cms: <= 2.1.1 (no fix yet)

Description

An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.

Related

Alias · CVE (1)

  • CVE-2022-34971 An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References