Arbitrary Command Injection Affecting microweber/microweber package, versions <1.3.3
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.16% (54th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-MICROWEBERMICROWEBER-5414887
- published 6 Apr 2023
- disclosed 6 Apr 2023
- credit Dan Barros
How to fix?
Upgrade microweber/microweber to version 1.3.3 or higher.
Overview
microweber/microweber is a new generation CMS with drag and drop.
Affected versions of this package are vulnerable to Arbitrary Command Injection due to improper user-input sanitization via the first name parameter.
References
CVSS Scores
version 3.1