vendor:
CCleague Pro Sports CMS
by:
Kacper (a.k.a Rahim)
7.5
CVSS
HIGH
Remote Code Execution
CWE
Product Name: CCleague Pro Sports CMS
Affected Version From: CCleague Pro Sports CMS <= 1.0.1RC1
Affected Version To:
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
CCleague Pro Sports CMS <= 1.0.1RC1 (Cookie) Remote Code Execution Exploit
This exploit allows remote code execution on the CCleague Pro Sports CMS version 1.0.1RC1. It takes advantage of the register_globals=On and magic quotes=off configurations.
Mitigation:
To mitigate this vulnerability, users should update to a newer version of CCleague Pro Sports CMS that has patched this issue. Additionally, enabling magic quotes and disabling register_globals can also help prevent this type of attack.
