CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.23.
Explanation of Vulnerability in Simple Terms
Paid Videochat Turnkey Site versions 7.3.23 and earlier contain a code injection vulnerability in a high-privilege function. An authenticated administrator can inject and execute arbitrary code on the site. The vulnerability affects confidentiality, integrity, and availability across the entire system.
What an attacker can do
Run arbitrary code on the site with full system access.
Potential impact on your site
A compromised admin account can execute code, steal data, modify content, and disable the site.
Conditions required to exploit
Attacker must have administrator-level access to the application.
Key dates
External resources
