CVE-2014-1683
N/A
N/A
Summary
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | n/a | n/a | affected |
Weaknesses
- n/a
ADP Enrichment
CVE Program Container
Additional References
- http://www.securityfocus.com/bid/65129
- http://seclists.org/fulldisclosure/2014/Jan/159
- http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90670
- http://www.exploit-db.com/exploits/31183
- http://www.exploit-db.com/exploits/31432
- http://secunia.com/advisories/56646
References
- http://www.securityfocus.com/bid/65129
- http://seclists.org/fulldisclosure/2014/Jan/159
- http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90670
- http://www.exploit-db.com/exploits/31183
- http://www.exploit-db.com/exploits/31432
- http://secunia.com/advisories/56646
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.