VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Sep 14, 2018· Updated Jun 17, 2026

CVE-2018-17036

CVE-2018-17036

Description

An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.

Affected products

4
  • Ucms/Ucmsllm-fuzzy
    Range: 1.4.6, 1.6
  • Bophia/Ucmsinferred
    Range: >=1.4.6,<=1.6
  • Ucms Project/Ucms2 versions
    cpe:2.3:a:ucms_project:ucms:1.4.6:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:ucms_project:ucms:1.4.6:*:*:*:*:*:*:*
    • cpe:2.3:a:ucms_project:ucms:1.6:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.