CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Slivery Extender slivery-extender allows Remote Code Inclusion.This issue affects Slivery Extender: from n/a through <= 1.0.2.
Explanation of Vulnerability in Simple Terms
Slivery Extender versions 1.0.2 and earlier allow authenticated users with low privileges to inject and execute arbitrary code on the site. The vulnerability exists because user input is not properly validated before being processed as code. An attacker can run their own PHP code on the site, potentially compromising the entire installation.
What an attacker can do
Run arbitrary code on the site with the privileges of the web server.
Potential impact on your site
Complete site compromise, data theft, malware installation, or site defacement possible.
Conditions required to exploit
Attacker must have a low-privilege authenticated account and network access to the site.
Key dates
External resources
Related vulnerabilities
