CVE-2018-10235

HIGH 7.2CVE-2018-10235 · Published 19/04/2018 · updated 17/06/2026

In short

CVE-2018-10235 is a HIGH (CVSS 7.2) vulnerability affecting poscms (poscms).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 73.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
poscms poscms	`= 3.2.10`	No fix yet

Description

POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache['setting']['ucssocfg'] in diy\module\member\models\Member_model.php and write this code into the api/ucsso/config.php file.

References

myndtt/vulnerability · Exploit

More vulnerabilities in poscms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free