| Package | Affected versions | Patched versions |
|---|---|---|
| otcms | = 3.85 |
OTCMS v3.85 allows arbitrary PHP Code Execution because admin/sysCheckFile_deal.php blocks "into outfile" in a SELECT statement, but does not block the "into/**/outfile" manipulation. Therefore, the attacker can create a .php file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free