Back to Database
Status published
Critical
CVE-2018-18934
An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable...
Vulnerability Description
An issue was discovered in PopojiCMS v2.0.1. admin_component.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code (that is extracted and can be executed). This can also be exploited via CSRF.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-18934
Credits & Attribution
No credits recorded in the NVD database.
References
More from popojicms
View All →CVE-2022-47766
PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability....
Unknown
0
CVE-2021-28070
Cross Site Request Forgery (CSRF) vulnerability exist in PopojiCMS 2.0.1...
Medium
4.3
CVE-2020-21357
A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of...
Medium
6.1
CVE-2020-21356
An information disclosure vulnerability in upload.php of PopojiCMS 1.2 leads...
Medium
5.3
CVE-2020-19547
Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id...
Medium
6.5
Affected Vendor
popojicms
View all reports →Affected Software
popojicms
Vulnerable Versions:
2.0.1
Timeline
Official Publish:
November 5th, 2018
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.