vendor:
ProcessMaker
by:
Brendan Coles
7.5
CVSS
HIGH
Arbitrary PHP Code Execution
CWE
Product Name: ProcessMaker
Affected Version From: 1.6-4276, 2.0.23, 3.0 RC 1, 3.2.0, 3.2.1
Affected Version To: 3.2.2000
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested: Windows 7 SP 1, Debian Linux 8
2010
ProcessMaker Plugin Upload
This module will generate and upload a plugin to ProcessMaker resulting in execution of PHP code as the web server user. Credentials for a valid user account with Administrator roles is required to run this module. This module has been tested successfully on ProcessMaker versions 1.6-4276, 2.0.23, 3.0 RC 1, 3.2.0, 3.2.1 on Windows 7 SP 1; and version 3.2.0 on Debian Linux 8.
Mitigation:
Unknown