Vulnerability Description
Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().'; (if the random prefix 4gH4_0df5_ were used).
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Codersclub | Discuz\!Ml | >= 3.2, <= 3.4 |
Related Weaknesses (CWE)
References
- http://esoln.net/esoln/blog/2019/06/14/discuzml-v-3-x-code-injection-vulnerabiliExploitThird Party Advisory
- http://esoln.net/esoln/blog/2019/06/14/discuzml-v-3-x-code-injection-vulnerabiliExploitThird Party Advisory
FAQ
What is CVE-2019-13956?
CVE-2019-13956 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Discuz!ML 3.2 through 3.4 allows remote attackers to execute arbitrary PHP code via a modified language cookie, as demonstrated by changing 4gH4_0df5_language=en to 4gH4_0df5_language=en'.phpinfo().';...
How severe is CVE-2019-13956?
CVE-2019-13956 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2019-13956?
Check the references section above for vendor advisories and patch information. Affected products include: Codersclub Discuz\!Ml.