Search criteria
17 vulnerabilities by otcms
CVE-2024-57252 (GCVE-0-2024-57252)
Vulnerability from cvelistv5 – Published: 2025-01-17 00:00 – Updated: 2025-01-17 21:14
VLAI?
Summary
OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
Severity ?
4.3 (Medium)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-57252",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-17T21:13:38.625100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-17T21:14:18.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OtCMS \u003c=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-17T20:17:18.159297",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/J-0k3r/some/blob/main/ssrf.pdf"
},
{
"url": "https://github.com/J-0k3r/CVE-2024-57252"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-57252",
"datePublished": "2025-01-17T00:00:00",
"dateReserved": "2025-01-09T00:00:00",
"dateUpdated": "2025-01-17T21:14:18.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-6772 (GCVE-0-2023-6772)
Vulnerability from cvelistv5 – Published: 2023-12-13 19:00 – Updated: 2025-05-22 18:05
VLAI?
Summary
A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908.
Severity ?
4.7 (Medium)
4.7 (Medium)
CWE
- CWE-89 - SQL Injection
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Credits
wuguanfengyue (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:42:07.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.247908"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.247908"
},
{
"tags": [
"exploit",
"issue-tracking",
"x_transferred"
],
"url": "https://github.com/Num-Nine/CVE/issues/8"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-6772",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-22T18:04:45.703959Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-22T18:05:37.845Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "7.01"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "wuguanfengyue (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in OTCMS 7.01 gefunden. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /admin/ind_backstage.php. Dank Manipulation des Arguments sqlContent mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 SQL Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-13T19:00:06.215Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.247908"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.247908"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/Num-Nine/CVE/issues/8"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-12-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-12-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-12-13T13:28:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS ind_backstage.php sql injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-6772",
"datePublished": "2023-12-13T19:00:06.215Z",
"dateReserved": "2023-12-13T12:23:34.610Z",
"dateUpdated": "2025-05-22T18:05:37.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3241 (GCVE-0-2023-3241)
Vulnerability from cvelistv5 – Published: 2023-06-14 09:00 – Updated: 2024-08-02 06:48
VLAI?
Summary
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
Severity ?
CWE
- CWE-22 - Path Traversal
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OTCMS |
Affected:
6.0
Affected: 6.1 Affected: 6.2 Affected: 6.3 Affected: 6.4 Affected: 6.5 Affected: 6.6 Affected: 6.7 Affected: 6.8 Affected: 6.9 Affected: 6.10 Affected: 6.11 Affected: 6.12 Affected: 6.13 Affected: 6.14 Affected: 6.15 Affected: 6.16 Affected: 6.17 Affected: 6.18 Affected: 6.19 Affected: 6.20 Affected: 6.21 Affected: 6.22 Affected: 6.23 Affected: 6.24 Affected: 6.25 Affected: 6.26 Affected: 6.27 Affected: 6.28 Affected: 6.29 Affected: 6.30 Affected: 6.31 Affected: 6.32 Affected: 6.33 Affected: 6.34 Affected: 6.35 Affected: 6.36 Affected: 6.37 Affected: 6.38 Affected: 6.39 Affected: 6.40 Affected: 6.41 Affected: 6.42 Affected: 6.43 Affected: 6.44 Affected: 6.45 Affected: 6.46 Affected: 6.47 Affected: 6.48 Affected: 6.49 Affected: 6.50 Affected: 6.51 Affected: 6.52 Affected: 6.53 Affected: 6.54 Affected: 6.55 Affected: 6.56 Affected: 6.57 Affected: 6.58 Affected: 6.59 Affected: 6.60 Affected: 6.61 Affected: 6.62 |
Credits
p0ison (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.520Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.231512"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.231512"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "6.5"
},
{
"status": "affected",
"version": "6.6"
},
{
"status": "affected",
"version": "6.7"
},
{
"status": "affected",
"version": "6.8"
},
{
"status": "affected",
"version": "6.9"
},
{
"status": "affected",
"version": "6.10"
},
{
"status": "affected",
"version": "6.11"
},
{
"status": "affected",
"version": "6.12"
},
{
"status": "affected",
"version": "6.13"
},
{
"status": "affected",
"version": "6.14"
},
{
"status": "affected",
"version": "6.15"
},
{
"status": "affected",
"version": "6.16"
},
{
"status": "affected",
"version": "6.17"
},
{
"status": "affected",
"version": "6.18"
},
{
"status": "affected",
"version": "6.19"
},
{
"status": "affected",
"version": "6.20"
},
{
"status": "affected",
"version": "6.21"
},
{
"status": "affected",
"version": "6.22"
},
{
"status": "affected",
"version": "6.23"
},
{
"status": "affected",
"version": "6.24"
},
{
"status": "affected",
"version": "6.25"
},
{
"status": "affected",
"version": "6.26"
},
{
"status": "affected",
"version": "6.27"
},
{
"status": "affected",
"version": "6.28"
},
{
"status": "affected",
"version": "6.29"
},
{
"status": "affected",
"version": "6.30"
},
{
"status": "affected",
"version": "6.31"
},
{
"status": "affected",
"version": "6.32"
},
{
"status": "affected",
"version": "6.33"
},
{
"status": "affected",
"version": "6.34"
},
{
"status": "affected",
"version": "6.35"
},
{
"status": "affected",
"version": "6.36"
},
{
"status": "affected",
"version": "6.37"
},
{
"status": "affected",
"version": "6.38"
},
{
"status": "affected",
"version": "6.39"
},
{
"status": "affected",
"version": "6.40"
},
{
"status": "affected",
"version": "6.41"
},
{
"status": "affected",
"version": "6.42"
},
{
"status": "affected",
"version": "6.43"
},
{
"status": "affected",
"version": "6.44"
},
{
"status": "affected",
"version": "6.45"
},
{
"status": "affected",
"version": "6.46"
},
{
"status": "affected",
"version": "6.47"
},
{
"status": "affected",
"version": "6.48"
},
{
"status": "affected",
"version": "6.49"
},
{
"status": "affected",
"version": "6.50"
},
{
"status": "affected",
"version": "6.51"
},
{
"status": "affected",
"version": "6.52"
},
{
"status": "affected",
"version": "6.53"
},
{
"status": "affected",
"version": "6.54"
},
{
"status": "affected",
"version": "6.55"
},
{
"status": "affected",
"version": "6.56"
},
{
"status": "affected",
"version": "6.57"
},
{
"status": "affected",
"version": "6.58"
},
{
"status": "affected",
"version": "6.59"
},
{
"status": "affected",
"version": "6.60"
},
{
"status": "affected",
"version": "6.61"
},
{
"status": "affected",
"version": "6.62"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p0ison (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in OTCMS bis 6.62 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /admin/read.php?mudi=announContent. Mittels Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.7,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T07:33:20.292Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.231512"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.231512"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-07-13T10:04:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-3241",
"datePublished": "2023-06-14T09:00:03.857Z",
"dateReserved": "2023-06-14T06:12:47.461Z",
"dateUpdated": "2024-08-02T06:48:08.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3240 (GCVE-0-2023-3240)
Vulnerability from cvelistv5 – Published: 2023-06-14 08:31 – Updated: 2024-11-21 16:06
VLAI?
Summary
A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.
Severity ?
CWE
- CWE-24 - Path Traversal: '../filedir'
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OTCMS |
Affected:
6.0
Affected: 6.1 Affected: 6.2 Affected: 6.3 Affected: 6.4 Affected: 6.5 Affected: 6.6 Affected: 6.7 Affected: 6.8 Affected: 6.9 Affected: 6.10 Affected: 6.11 Affected: 6.12 Affected: 6.13 Affected: 6.14 Affected: 6.15 Affected: 6.16 Affected: 6.17 Affected: 6.18 Affected: 6.19 Affected: 6.20 Affected: 6.21 Affected: 6.22 Affected: 6.23 Affected: 6.24 Affected: 6.25 Affected: 6.26 Affected: 6.27 Affected: 6.28 Affected: 6.29 Affected: 6.30 Affected: 6.31 Affected: 6.32 Affected: 6.33 Affected: 6.34 Affected: 6.35 Affected: 6.36 Affected: 6.37 Affected: 6.38 Affected: 6.39 Affected: 6.40 Affected: 6.41 Affected: 6.42 Affected: 6.43 Affected: 6.44 Affected: 6.45 Affected: 6.46 Affected: 6.47 Affected: 6.48 Affected: 6.49 Affected: 6.50 Affected: 6.51 Affected: 6.52 Affected: 6.53 Affected: 6.54 Affected: 6.55 Affected: 6.56 Affected: 6.57 Affected: 6.58 Affected: 6.59 Affected: 6.60 Affected: 6.61 Affected: 6.62 |
Credits
p0ison (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.231511"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.231511"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-21T16:06:39.308991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-21T16:06:53.483Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "6.5"
},
{
"status": "affected",
"version": "6.6"
},
{
"status": "affected",
"version": "6.7"
},
{
"status": "affected",
"version": "6.8"
},
{
"status": "affected",
"version": "6.9"
},
{
"status": "affected",
"version": "6.10"
},
{
"status": "affected",
"version": "6.11"
},
{
"status": "affected",
"version": "6.12"
},
{
"status": "affected",
"version": "6.13"
},
{
"status": "affected",
"version": "6.14"
},
{
"status": "affected",
"version": "6.15"
},
{
"status": "affected",
"version": "6.16"
},
{
"status": "affected",
"version": "6.17"
},
{
"status": "affected",
"version": "6.18"
},
{
"status": "affected",
"version": "6.19"
},
{
"status": "affected",
"version": "6.20"
},
{
"status": "affected",
"version": "6.21"
},
{
"status": "affected",
"version": "6.22"
},
{
"status": "affected",
"version": "6.23"
},
{
"status": "affected",
"version": "6.24"
},
{
"status": "affected",
"version": "6.25"
},
{
"status": "affected",
"version": "6.26"
},
{
"status": "affected",
"version": "6.27"
},
{
"status": "affected",
"version": "6.28"
},
{
"status": "affected",
"version": "6.29"
},
{
"status": "affected",
"version": "6.30"
},
{
"status": "affected",
"version": "6.31"
},
{
"status": "affected",
"version": "6.32"
},
{
"status": "affected",
"version": "6.33"
},
{
"status": "affected",
"version": "6.34"
},
{
"status": "affected",
"version": "6.35"
},
{
"status": "affected",
"version": "6.36"
},
{
"status": "affected",
"version": "6.37"
},
{
"status": "affected",
"version": "6.38"
},
{
"status": "affected",
"version": "6.39"
},
{
"status": "affected",
"version": "6.40"
},
{
"status": "affected",
"version": "6.41"
},
{
"status": "affected",
"version": "6.42"
},
{
"status": "affected",
"version": "6.43"
},
{
"status": "affected",
"version": "6.44"
},
{
"status": "affected",
"version": "6.45"
},
{
"status": "affected",
"version": "6.46"
},
{
"status": "affected",
"version": "6.47"
},
{
"status": "affected",
"version": "6.48"
},
{
"status": "affected",
"version": "6.49"
},
{
"status": "affected",
"version": "6.50"
},
{
"status": "affected",
"version": "6.51"
},
{
"status": "affected",
"version": "6.52"
},
{
"status": "affected",
"version": "6.53"
},
{
"status": "affected",
"version": "6.54"
},
{
"status": "affected",
"version": "6.55"
},
{
"status": "affected",
"version": "6.56"
},
{
"status": "affected",
"version": "6.57"
},
{
"status": "affected",
"version": "6.58"
},
{
"status": "affected",
"version": "6.59"
},
{
"status": "affected",
"version": "6.60"
},
{
"status": "affected",
"version": "6.61"
},
{
"status": "affected",
"version": "6.62"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p0ison (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511."
},
{
"lang": "de",
"value": "In OTCMS bis 6.62 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei usersNews_deal.php. Mittels dem Manipulieren des Arguments file mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.7,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T07:35:51.673Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.231511"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.231511"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-07-13T10:00:15.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS usersNews_deal.php path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-3240",
"datePublished": "2023-06-14T08:31:04.377Z",
"dateReserved": "2023-06-14T06:12:42.962Z",
"dateUpdated": "2024-11-21T16:06:53.483Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3239 (GCVE-0-2023-3239)
Vulnerability from cvelistv5 – Published: 2023-06-14 08:31 – Updated: 2024-08-02 06:48
VLAI?
Summary
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
Severity ?
CWE
- CWE-24 - Path Traversal: '../filedir'
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OTCMS |
Affected:
6.0
Affected: 6.1 Affected: 6.2 Affected: 6.3 Affected: 6.4 Affected: 6.5 Affected: 6.6 Affected: 6.7 Affected: 6.8 Affected: 6.9 Affected: 6.10 Affected: 6.11 Affected: 6.12 Affected: 6.13 Affected: 6.14 Affected: 6.15 Affected: 6.16 Affected: 6.17 Affected: 6.18 Affected: 6.19 Affected: 6.20 Affected: 6.21 Affected: 6.22 Affected: 6.23 Affected: 6.24 Affected: 6.25 Affected: 6.26 Affected: 6.27 Affected: 6.28 Affected: 6.29 Affected: 6.30 Affected: 6.31 Affected: 6.32 Affected: 6.33 Affected: 6.34 Affected: 6.35 Affected: 6.36 Affected: 6.37 Affected: 6.38 Affected: 6.39 Affected: 6.40 Affected: 6.41 Affected: 6.42 Affected: 6.43 Affected: 6.44 Affected: 6.45 Affected: 6.46 Affected: 6.47 Affected: 6.48 Affected: 6.49 Affected: 6.50 Affected: 6.51 Affected: 6.52 Affected: 6.53 Affected: 6.54 Affected: 6.55 Affected: 6.56 Affected: 6.57 Affected: 6.58 Affected: 6.59 Affected: 6.60 Affected: 6.61 Affected: 6.62 |
Credits
p0ison (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.286Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.231510"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.231510"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "6.5"
},
{
"status": "affected",
"version": "6.6"
},
{
"status": "affected",
"version": "6.7"
},
{
"status": "affected",
"version": "6.8"
},
{
"status": "affected",
"version": "6.9"
},
{
"status": "affected",
"version": "6.10"
},
{
"status": "affected",
"version": "6.11"
},
{
"status": "affected",
"version": "6.12"
},
{
"status": "affected",
"version": "6.13"
},
{
"status": "affected",
"version": "6.14"
},
{
"status": "affected",
"version": "6.15"
},
{
"status": "affected",
"version": "6.16"
},
{
"status": "affected",
"version": "6.17"
},
{
"status": "affected",
"version": "6.18"
},
{
"status": "affected",
"version": "6.19"
},
{
"status": "affected",
"version": "6.20"
},
{
"status": "affected",
"version": "6.21"
},
{
"status": "affected",
"version": "6.22"
},
{
"status": "affected",
"version": "6.23"
},
{
"status": "affected",
"version": "6.24"
},
{
"status": "affected",
"version": "6.25"
},
{
"status": "affected",
"version": "6.26"
},
{
"status": "affected",
"version": "6.27"
},
{
"status": "affected",
"version": "6.28"
},
{
"status": "affected",
"version": "6.29"
},
{
"status": "affected",
"version": "6.30"
},
{
"status": "affected",
"version": "6.31"
},
{
"status": "affected",
"version": "6.32"
},
{
"status": "affected",
"version": "6.33"
},
{
"status": "affected",
"version": "6.34"
},
{
"status": "affected",
"version": "6.35"
},
{
"status": "affected",
"version": "6.36"
},
{
"status": "affected",
"version": "6.37"
},
{
"status": "affected",
"version": "6.38"
},
{
"status": "affected",
"version": "6.39"
},
{
"status": "affected",
"version": "6.40"
},
{
"status": "affected",
"version": "6.41"
},
{
"status": "affected",
"version": "6.42"
},
{
"status": "affected",
"version": "6.43"
},
{
"status": "affected",
"version": "6.44"
},
{
"status": "affected",
"version": "6.45"
},
{
"status": "affected",
"version": "6.46"
},
{
"status": "affected",
"version": "6.47"
},
{
"status": "affected",
"version": "6.48"
},
{
"status": "affected",
"version": "6.49"
},
{
"status": "affected",
"version": "6.50"
},
{
"status": "affected",
"version": "6.51"
},
{
"status": "affected",
"version": "6.52"
},
{
"status": "affected",
"version": "6.53"
},
{
"status": "affected",
"version": "6.54"
},
{
"status": "affected",
"version": "6.55"
},
{
"status": "affected",
"version": "6.56"
},
{
"status": "affected",
"version": "6.57"
},
{
"status": "affected",
"version": "6.58"
},
{
"status": "affected",
"version": "6.59"
},
{
"status": "affected",
"version": "6.60"
},
{
"status": "affected",
"version": "6.61"
},
{
"status": "affected",
"version": "6.62"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p0ison (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in OTCMS bis 6.62 gefunden. Sie wurde als problematisch eingestuft. Es betrifft eine unbekannte Funktion der Datei admin/readDeal.php?mudi=readQrCode. Durch Manipulation des Arguments img mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.7,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-24",
"description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T07:39:22.646Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.231510"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.231510"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-07-13T09:56:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS path traversal"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-3239",
"datePublished": "2023-06-14T08:31:03.407Z",
"dateReserved": "2023-06-14T06:12:39.708Z",
"dateUpdated": "2024-08-02T06:48:08.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3238 (GCVE-0-2023-3238)
Vulnerability from cvelistv5 – Published: 2023-06-14 08:00 – Updated: 2025-01-02 20:40
VLAI?
Summary
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability.
Severity ?
6.3 (Medium)
6.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OTCMS |
Affected:
6.0
Affected: 6.1 Affected: 6.2 Affected: 6.3 Affected: 6.4 Affected: 6.5 Affected: 6.6 Affected: 6.7 Affected: 6.8 Affected: 6.9 Affected: 6.10 Affected: 6.11 Affected: 6.12 Affected: 6.13 Affected: 6.14 Affected: 6.15 Affected: 6.16 Affected: 6.17 Affected: 6.18 Affected: 6.19 Affected: 6.20 Affected: 6.21 Affected: 6.22 Affected: 6.23 Affected: 6.24 Affected: 6.25 Affected: 6.26 Affected: 6.27 Affected: 6.28 Affected: 6.29 Affected: 6.30 Affected: 6.31 Affected: 6.32 Affected: 6.33 Affected: 6.34 Affected: 6.35 Affected: 6.36 Affected: 6.37 Affected: 6.38 Affected: 6.39 Affected: 6.40 Affected: 6.41 Affected: 6.42 Affected: 6.43 Affected: 6.44 Affected: 6.45 Affected: 6.46 Affected: 6.47 Affected: 6.48 Affected: 6.49 Affected: 6.50 Affected: 6.51 Affected: 6.52 Affected: 6.53 Affected: 6.54 Affected: 6.55 Affected: 6.56 Affected: 6.57 Affected: 6.58 Affected: 6.59 Affected: 6.60 Affected: 6.61 Affected: 6.62 |
Credits
p0ison (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.231509"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.231509"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-02T20:40:02.501241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T20:40:18.187Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "6.5"
},
{
"status": "affected",
"version": "6.6"
},
{
"status": "affected",
"version": "6.7"
},
{
"status": "affected",
"version": "6.8"
},
{
"status": "affected",
"version": "6.9"
},
{
"status": "affected",
"version": "6.10"
},
{
"status": "affected",
"version": "6.11"
},
{
"status": "affected",
"version": "6.12"
},
{
"status": "affected",
"version": "6.13"
},
{
"status": "affected",
"version": "6.14"
},
{
"status": "affected",
"version": "6.15"
},
{
"status": "affected",
"version": "6.16"
},
{
"status": "affected",
"version": "6.17"
},
{
"status": "affected",
"version": "6.18"
},
{
"status": "affected",
"version": "6.19"
},
{
"status": "affected",
"version": "6.20"
},
{
"status": "affected",
"version": "6.21"
},
{
"status": "affected",
"version": "6.22"
},
{
"status": "affected",
"version": "6.23"
},
{
"status": "affected",
"version": "6.24"
},
{
"status": "affected",
"version": "6.25"
},
{
"status": "affected",
"version": "6.26"
},
{
"status": "affected",
"version": "6.27"
},
{
"status": "affected",
"version": "6.28"
},
{
"status": "affected",
"version": "6.29"
},
{
"status": "affected",
"version": "6.30"
},
{
"status": "affected",
"version": "6.31"
},
{
"status": "affected",
"version": "6.32"
},
{
"status": "affected",
"version": "6.33"
},
{
"status": "affected",
"version": "6.34"
},
{
"status": "affected",
"version": "6.35"
},
{
"status": "affected",
"version": "6.36"
},
{
"status": "affected",
"version": "6.37"
},
{
"status": "affected",
"version": "6.38"
},
{
"status": "affected",
"version": "6.39"
},
{
"status": "affected",
"version": "6.40"
},
{
"status": "affected",
"version": "6.41"
},
{
"status": "affected",
"version": "6.42"
},
{
"status": "affected",
"version": "6.43"
},
{
"status": "affected",
"version": "6.44"
},
{
"status": "affected",
"version": "6.45"
},
{
"status": "affected",
"version": "6.46"
},
{
"status": "affected",
"version": "6.47"
},
{
"status": "affected",
"version": "6.48"
},
{
"status": "affected",
"version": "6.49"
},
{
"status": "affected",
"version": "6.50"
},
{
"status": "affected",
"version": "6.51"
},
{
"status": "affected",
"version": "6.52"
},
{
"status": "affected",
"version": "6.53"
},
{
"status": "affected",
"version": "6.54"
},
{
"status": "affected",
"version": "6.55"
},
{
"status": "affected",
"version": "6.56"
},
{
"status": "affected",
"version": "6.57"
},
{
"status": "affected",
"version": "6.58"
},
{
"status": "affected",
"version": "6.59"
},
{
"status": "affected",
"version": "6.60"
},
{
"status": "affected",
"version": "6.61"
},
{
"status": "affected",
"version": "6.62"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p0ison (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in OTCMS bis 6.62 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /admin/read.php?mudi=getSignal. Durch die Manipulation des Arguments signalUrl mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T07:38:01.904Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.231509"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.231509"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-07-13T09:50:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-3238",
"datePublished": "2023-06-14T08:00:04.536Z",
"dateReserved": "2023-06-14T06:12:36.410Z",
"dateUpdated": "2025-01-02T20:40:18.187Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-3237 (GCVE-0-2023-3237)
Vulnerability from cvelistv5 – Published: 2023-06-14 07:31 – Updated: 2024-08-02 06:48
VLAI?
Summary
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
Severity ?
6.3 (Medium)
6.3 (Medium)
CWE
- CWE-259 - Use of Hard-coded Password
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | OTCMS |
Affected:
6.0
Affected: 6.1 Affected: 6.2 Affected: 6.3 Affected: 6.4 Affected: 6.5 Affected: 6.6 Affected: 6.7 Affected: 6.8 Affected: 6.9 Affected: 6.10 Affected: 6.11 Affected: 6.12 Affected: 6.13 Affected: 6.14 Affected: 6.15 Affected: 6.16 Affected: 6.17 Affected: 6.18 Affected: 6.19 Affected: 6.20 Affected: 6.21 Affected: 6.22 Affected: 6.23 Affected: 6.24 Affected: 6.25 Affected: 6.26 Affected: 6.27 Affected: 6.28 Affected: 6.29 Affected: 6.30 Affected: 6.31 Affected: 6.32 Affected: 6.33 Affected: 6.34 Affected: 6.35 Affected: 6.36 Affected: 6.37 Affected: 6.38 Affected: 6.39 Affected: 6.40 Affected: 6.41 Affected: 6.42 Affected: 6.43 Affected: 6.44 Affected: 6.45 Affected: 6.46 Affected: 6.47 Affected: 6.48 Affected: 6.49 Affected: 6.50 Affected: 6.51 Affected: 6.52 Affected: 6.53 Affected: 6.54 Affected: 6.55 Affected: 6.56 Affected: 6.57 Affected: 6.58 Affected: 6.59 Affected: 6.60 Affected: 6.61 Affected: 6.62 |
Credits
p0ison (VulDB User)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-18T14:44:49.636969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-18T14:46:21.995Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:48:08.227Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.231508"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.231508"
},
{
"tags": [
"broken-link",
"exploit",
"x_transferred"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"status": "affected",
"version": "6.1"
},
{
"status": "affected",
"version": "6.2"
},
{
"status": "affected",
"version": "6.3"
},
{
"status": "affected",
"version": "6.4"
},
{
"status": "affected",
"version": "6.5"
},
{
"status": "affected",
"version": "6.6"
},
{
"status": "affected",
"version": "6.7"
},
{
"status": "affected",
"version": "6.8"
},
{
"status": "affected",
"version": "6.9"
},
{
"status": "affected",
"version": "6.10"
},
{
"status": "affected",
"version": "6.11"
},
{
"status": "affected",
"version": "6.12"
},
{
"status": "affected",
"version": "6.13"
},
{
"status": "affected",
"version": "6.14"
},
{
"status": "affected",
"version": "6.15"
},
{
"status": "affected",
"version": "6.16"
},
{
"status": "affected",
"version": "6.17"
},
{
"status": "affected",
"version": "6.18"
},
{
"status": "affected",
"version": "6.19"
},
{
"status": "affected",
"version": "6.20"
},
{
"status": "affected",
"version": "6.21"
},
{
"status": "affected",
"version": "6.22"
},
{
"status": "affected",
"version": "6.23"
},
{
"status": "affected",
"version": "6.24"
},
{
"status": "affected",
"version": "6.25"
},
{
"status": "affected",
"version": "6.26"
},
{
"status": "affected",
"version": "6.27"
},
{
"status": "affected",
"version": "6.28"
},
{
"status": "affected",
"version": "6.29"
},
{
"status": "affected",
"version": "6.30"
},
{
"status": "affected",
"version": "6.31"
},
{
"status": "affected",
"version": "6.32"
},
{
"status": "affected",
"version": "6.33"
},
{
"status": "affected",
"version": "6.34"
},
{
"status": "affected",
"version": "6.35"
},
{
"status": "affected",
"version": "6.36"
},
{
"status": "affected",
"version": "6.37"
},
{
"status": "affected",
"version": "6.38"
},
{
"status": "affected",
"version": "6.39"
},
{
"status": "affected",
"version": "6.40"
},
{
"status": "affected",
"version": "6.41"
},
{
"status": "affected",
"version": "6.42"
},
{
"status": "affected",
"version": "6.43"
},
{
"status": "affected",
"version": "6.44"
},
{
"status": "affected",
"version": "6.45"
},
{
"status": "affected",
"version": "6.46"
},
{
"status": "affected",
"version": "6.47"
},
{
"status": "affected",
"version": "6.48"
},
{
"status": "affected",
"version": "6.49"
},
{
"status": "affected",
"version": "6.50"
},
{
"status": "affected",
"version": "6.51"
},
{
"status": "affected",
"version": "6.52"
},
{
"status": "affected",
"version": "6.53"
},
{
"status": "affected",
"version": "6.54"
},
{
"status": "affected",
"version": "6.55"
},
{
"status": "affected",
"version": "6.56"
},
{
"status": "affected",
"version": "6.57"
},
{
"status": "affected",
"version": "6.58"
},
{
"status": "affected",
"version": "6.59"
},
{
"status": "affected",
"version": "6.60"
},
{
"status": "affected",
"version": "6.61"
},
{
"status": "affected",
"version": "6.62"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "p0ison (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."
},
{
"lang": "de",
"value": "In OTCMS bis 6.62 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion. Mit der Manipulation des Arguments username/password mit der Eingabe admin mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.8,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-259",
"description": "CWE-259 Use of Hard-coded Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T07:34:51.152Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.231508"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.231508"
},
{
"tags": [
"broken-link",
"exploit"
],
"url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-06-14T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-06-14T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-07-13T09:47:27.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS hard-coded password"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-3237",
"datePublished": "2023-06-14T07:31:03.348Z",
"dateReserved": "2023-06-14T06:12:33.580Z",
"dateUpdated": "2024-08-02T06:48:08.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1797 (GCVE-0-2023-1797)
Vulnerability from cvelistv5 – Published: 2023-04-02 09:00 – Updated: 2024-08-02 06:05
VLAI?
Summary
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability.
Severity ?
6.3 (Medium)
6.3 (Medium)
CWE
- CWE-434 - Unrestricted Upload
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Credits
wkstestete (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:05:26.160Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.224749"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.224749"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "wkstestete (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability."
},
{
"lang": "de",
"value": "In OTCMS 6.0.1 wurde eine kritische Schwachstelle entdeckt. Hierbei betrifft es unbekannten Programmcode der Datei sysCheckFile.php?mudi=sql. Durch Manipulieren mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-21T14:34:21.879Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.224749"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.224749"
},
{
"tags": [
"exploit"
],
"url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-02T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-21T14:11:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS unrestricted upload"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-1797",
"datePublished": "2023-04-02T09:00:07.864Z",
"dateReserved": "2023-04-02T07:27:18.541Z",
"dateUpdated": "2024-08-02T06:05:26.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1635 (GCVE-0-2023-1635)
Vulnerability from cvelistv5 – Published: 2023-03-25 19:00 – Updated: 2025-02-14 16:09
VLAI?
Summary
A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.
Severity ?
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Credits
fzh1613 (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.224017"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.224017"
},
{
"tags": [
"related",
"x_transferred"
],
"url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1635",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-14T16:09:37.641680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-14T16:09:51.822Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.72"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "fzh1613 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability."
},
{
"lang": "de",
"value": "In OTCMS 6.72 wurde eine problematische Schwachstelle ausgemacht. Betroffen ist die Funktion AutoRun der Datei apiRun.php. Mit der Manipulation des Arguments mode mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-21T13:26:03.756Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.224017"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.224017"
},
{
"tags": [
"related"
],
"url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-03-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-03-25T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-03-25T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-15T10:51:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS apiRun.php AutoRun cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-1635",
"datePublished": "2023-03-25T19:00:05.453Z",
"dateReserved": "2023-03-25T18:03:19.149Z",
"dateUpdated": "2025-02-14T16:09:51.822Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1634 (GCVE-0-2023-1634)
Vulnerability from cvelistv5 – Published: 2023-03-25 18:31 – Updated: 2024-08-02 05:57
VLAI?
Summary
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.
Severity ?
6.3 (Medium)
6.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Credits
fzh1613 (VulDB User)
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T05:57:24.427Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.224016"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.224016"
},
{
"tags": [
"exploit",
"x_transferred"
],
"url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"URL Parameter Handler"
],
"product": "OTCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "6.72"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "analyst",
"value": "fzh1613 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016."
},
{
"lang": "de",
"value": "Es wurde eine kritische Schwachstelle in OTCMS 6.72 ausgemacht. Hiervon betroffen ist die Funktion UseCurl der Datei /admin/info_deal.php der Komponente URL Parameter Handler. Dank Manipulation mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-21T13:24:50.572Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.224016"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.224016"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-03-25T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-03-25T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-03-25T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-15T10:39:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "OTCMS URL Parameter info_deal.php UseCurl server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2023-1634",
"datePublished": "2023-03-25T18:31:03.362Z",
"dateReserved": "2023-03-25T18:01:16.544Z",
"dateUpdated": "2024-08-02T05:57:24.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-17370 (GCVE-0-2019-17370)
Vulnerability from cvelistv5 – Published: 2019-10-09 11:04 – Updated: 2024-08-05 01:40
VLAI?
Summary
OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation. Therefore, the attacker can create a .php file.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.249Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks \"into outfile\" in a SELECT statement, but does not block the \"into/**/outfile\" manipulation. Therefore, the attacker can create a .php file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-09T11:04:25",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17370",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks \"into outfile\" in a SELECT statement, but does not block the \"into/**/outfile\" manipulation. Therefore, the attacker can create a .php file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md",
"refsource": "MISC",
"url": "https://github.com/Gitaddy/vluns/blob/master/Otcms-getshell.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17370",
"datePublished": "2019-10-09T11:04:25",
"dateReserved": "2019-10-09T00:00:00",
"dateUpdated": "2024-08-05T01:40:15.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-17369 (GCVE-0-2019-17369)
Vulnerability from cvelistv5 – Published: 2019-10-09 10:55 – Updated: 2024-08-05 01:40
VLAI?
Summary
OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T01:40:15.208Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Gitaddy/vluns/blob/master/Otcms-CSRF.md"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-10-09T10:55:46",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Gitaddy/vluns/blob/master/Otcms-CSRF.md"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-17369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OTCMS v3.85 has CSRF in the admin/member_deal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Gitaddy/vluns/blob/master/Otcms-CSRF.md",
"refsource": "MISC",
"url": "https://github.com/Gitaddy/vluns/blob/master/Otcms-CSRF.md"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-17369",
"datePublished": "2019-10-09T10:55:46",
"dateReserved": "2019-10-09T00:00:00",
"dateUpdated": "2024-08-05T01:40:15.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-13971 (GCVE-0-2019-13971)
Vulnerability from cvelistv5 – Published: 2019-07-19 06:07 – Updated: 2024-08-05 00:05
VLAI?
Summary
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T00:05:44.059Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://cisk123456.blogspot.com/2019/05/otcms-xss.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-07-19T06:07:41",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://cisk123456.blogspot.com/2019/05/otcms-xss.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-13971",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://cisk123456.blogspot.com/2019/05/otcms-xss.html",
"refsource": "MISC",
"url": "https://cisk123456.blogspot.com/2019/05/otcms-xss.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-13971",
"datePublished": "2019-07-19T06:07:41",
"dateReserved": "2019-07-19T00:00:00",
"dateUpdated": "2024-08-05T00:05:44.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17364 (GCVE-0-2018-17364)
Vulnerability from cvelistv5 – Published: 2018-09-23 18:00 – Updated: 2024-08-05 10:47
VLAI?
Summary
OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T10:47:04.333Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-23T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-17364",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OTCMS 3.61 allows remote attackers to execute arbitrary PHP code via the accBackupDir parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html",
"refsource": "MISC",
"url": "https://xiaohuihui1.blogspot.com/2018/09/otcms-361-command-execution.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-17364",
"datePublished": "2018-09-23T18:00:00",
"dateReserved": "2018-09-23T00:00:00",
"dateUpdated": "2024-08-05T10:47:04.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17086 (GCVE-0-2018-17086)
Vulnerability from cvelistv5 – Published: 2018-09-16 17:00 – Updated: 2024-08-05 10:39
VLAI?
Summary
An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T10:39:59.562Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-shareswitchphp.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-16T17:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-shareswitchphp.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-17086",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-shareswitchphp.html",
"refsource": "MISC",
"url": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-shareswitchphp.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-17086",
"datePublished": "2018-09-16T17:00:00",
"dateReserved": "2018-09-16T00:00:00",
"dateUpdated": "2024-08-05T10:39:59.562Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-17085 (GCVE-0-2018-17085)
Vulnerability from cvelistv5 – Published: 2018-09-16 17:00 – Updated: 2024-08-05 10:39
VLAI?
Summary
An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T10:39:59.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-usersphp.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-09-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-09-16T17:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-usersphp.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-17085",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-usersphp.html",
"refsource": "MISC",
"url": "http://secwk.blogspot.com/2018/09/otcms-361-reflected-xss-usersphp.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-17085",
"datePublished": "2018-09-16T17:00:00",
"dateReserved": "2018-09-16T00:00:00",
"dateUpdated": "2024-08-05T10:39:59.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-8973 (GCVE-0-2018-8973)
Vulnerability from cvelistv5 – Published: 2018-03-24 22:00 – Updated: 2024-09-16 17:28
VLAI?
Summary
OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord_deal.php?mudi=add request.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:10:47.356Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/yaxuan404/OTCMS_3.2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord_deal.php?mudi=add request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-03-24T22:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/yaxuan404/OTCMS_3.2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-8973",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OTCMS 3.20 allows XSS by adding a keyword or link to an article, as demonstrated by an admin/keyWord_deal.php?mudi=add request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/yaxuan404/OTCMS_3.2",
"refsource": "MISC",
"url": "https://github.com/yaxuan404/OTCMS_3.2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-8973",
"datePublished": "2018-03-24T22:00:00Z",
"dateReserved": "2018-03-24T00:00:00Z",
"dateUpdated": "2024-09-16T17:28:29.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}