CVE-2014-1683

The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.

🔗 References (14)

• cve@mitrehttp://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html
• cve@mitrehttp://seclists.org/fulldisclosure/2014/Jan/159
• cve@mitrehttp://secunia.com/advisories/56646
• cve@mitrehttp://www.exploit-db.com/exploits/31183
• cve@mitrehttp://www.exploit-db.com/exploits/31432
• cve@mitrehttp://www.securityfocus.com/bid/65129
• cve@mitrehttps://exchange.xforce.ibmcloud.com/vulnerabilities/90670
• af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html
• af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2014/Jan/159
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/56646
• af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/31183
• af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/31432
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/65129
• af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/90670