An attacker can exploit this to execute arbitrary SQL commands with root privileges. Reportedly, the vendor had fixed the issue in version 1.1.1, released on August 7, 2018.
1. Plexus CMS/Pinnacle CMS
Another critical CMS that has been under fire for its lack of critical patches is Plexus/Pinnacle CMS. The arrary of flaws found in this CMS is overwhelming. However, one of the most critical vulnerabilities discovered in Plexus/Pinnacle CMS is the SQL injection flaw at any of the following locations:
/admin/settings.php
/admin/add.php
/admin/search.php
/admin/login.php
/admin/editProfile.php
/admin/profile.php
/admin/editGroup.php
/admin/editSubGroup.php
/admin/editSubCategory.php
/admin/editRelatedCategory.php
/admin/editRelatedCategory.php
/Admin/content.php
/Admin/editAll.php
/Admin/editAll.php
/Admin/addAdmin.php
/Admin/deleteAdmin.php
/Admin/deleteAdmin.php
/Admin/deleteAdmin.php
/Admin/deleteAdmin.php
/Admin/deleteAdmin.php
/Admin/deleteAdmin.php
Apache Struts
A flaw in the Apache Struts library has been exploited by attackers to execute arbitrary commands as root on webservers.
CVE-2018-11776
Timeline
Published on: 11/09/2022 16:15:00 UTC
Last modified on: 11/09/2022 17:07:00 UTC