Server-Side Template Injection in Camaleon CMS

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-30145 · ADVISORY
• owen2345/camaleon-cms · WEB
• owen2345/camaleon-cms commit 4485788 · WEB
• book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection · WEB
• drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view · WEB
• owen2345/camaleon-cms · PACKAGE
• owen2345/camaleon-cms release 2.7.4 · WEB
• paragbagul111/CVE-2023-30145 · WEB
• rubysec/ruby-advisory-db · WEB
• portswigger.net/research/server-side-template-injection · WEB
• packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html

camaleon_cms のその他の脆弱性

• CVE-2026-1776中 6.5Camaleon CMS versions 2.4.5.0 through 2.9.0, prior to commit f54a77e, contain a path traversal vulnerability in the AWS S3 uploader implemen…
• CVE-2025-2304緊急 9.4A Privilege Escalation through a Mass Assignment exists in Camaleon CMS When a user wishes to change his password, the 'updated_ajax' metho…
• CVE-2024-48652中 4.8Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name field…
• GHSA-75j2-9gmc-m855中 5.4Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)
• GHSA-8fx8-3rg2-79xw中 5.4Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)