VulnerabilityModified
CVE-2014-9185
Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.
MEDIUM 6.5EPSS 2.12%
Does this matter?
Lower severity and a low EPSS score (2.12%). Track it; it rarely justifies an emergency change on its own.
Description
Static code injection vulnerability in install.php in Morfy CMS 1.05 allows remote authenticated users to inject arbitrary PHP code into config.php via the site_url parameter.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 2.12% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- morfy cms project/morfy cms
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/129624/Morfy-CMS-1.05-Remote-Command-Execution.htmlExploit
- http://seclists.org/fulldisclosure/2014/Dec/70Exploit
- http://www.securityfocus.com/archive/1/534271/100/0/threaded
- http://www.vulnerability-lab.com/get_content.php?id=1367Exploit
- https://github.com/Awilum/monstra-cms/issues/351
- http://packetstormsecurity.com/files/129624/Morfy-CMS-1.05-Remote-Command-Execution.htmlExploit
- http://seclists.org/fulldisclosure/2014/Dec/70Exploit
- http://www.securityfocus.com/archive/1/534271/100/0/threaded
- http://www.vulnerability-lab.com/get_content.php?id=1367Exploit
- https://github.com/Awilum/monstra-cms/issues/351
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.