A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser.php of the component Frontend/Template Management Module. This manipulation causes improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited.
Weakness
The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ctcms | Ctcms_project | * | 2.1.2 (including) |
References
- https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN
- https://note-hxlab.wetolink.com/share/U6cnRoRfn09r
- https://vuldb.com/?ctiid.336488
- https://vuldb.com/?id.336488
- https://vuldb.com/?submit.707106
- https://vuldb.com/?submit.707107
- https://note-hxlab.wetolink.com/share/Ros8ZIeCLQrN
- https://note-hxlab.wetolink.com/share/U6cnRoRfn09r