CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Eli Scheetz Anti-Malware Security and Brute-Force Firewall gotmls allows Code Injection.This issue affects Anti-Malware Security and Brute-Force Firewall: from n/a through 4.21.96.
Explanation of Vulnerability in Simple Terms
The Anti-Malware Security and Brute-Force Firewall plugin contains a code injection vulnerability that allows an attacker to run arbitrary PHP code on an affected site. The vulnerability requires specific network conditions to exploit but does not require authentication or user interaction. Successful exploitation grants full control over the site, including the ability to read, modify, or delete data.
What an attacker can do
Run their own PHP code on the site to steal data, modify content, or take control.
Potential impact on your site
Complete compromise of the site and all data stored in its database.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
