CVE-2019-10015

Published: Mar 24, 2019Modified: Nov 21, 2024

7.2

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.

Affected (1)

Products: Baigo: Baigo Sso

Baigo

1 product

Baigo Sso

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Baigo Baigo Sso	Version 3.0.1

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/baigoStudio/baigoSSO/issues/12

Source: cve@mitre.org

Third Party Advisory

https://github.com/baigoStudio/baigoSSO/issues/12

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.