Vulnerabilities > CVE-2020-5295 - PHP Remote File Inclusion vulnerability in Octobercms October

CVSS 4.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

network

low complexity

octobercms

CWE-98

NVD

Published: 2020-06-03

Updated: 2022-06-30

Summary

In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

Vulnerable Configurations

Part	Description	Count
Application	Octobercms Octobercms October 1.0.319 Octobercms October 1.0.320 Octobercms October 1.0.321 Octobercms October 1.0.322 Octobercms October 1.0.323 Octobercms October 1.0.324 Octobercms October 1.0.325 Octobercms October 1.0.326 Octobercms October 1.0.327 Octobercms October 1.0.328 Octobercms October 1.0.329 Octobercms October 1.0.330 Octobercms October 1.0.331 Octobercms October 1.0.332 Octobercms October 1.0.333 Octobercms October 1.0.334 Octobercms October 1.0.335 Octobercms October 1.0.336 Octobercms October 1.0.337 Octobercms October 1.0.338 Octobercms October 1.0.339 Octobercms October 1.0.340 Octobercms October 1.0.341 Octobercms October 1.0.342 Octobercms October 1.0.343 Octobercms October 1.0.344 Octobercms October 1.0.345 Octobercms October 1.0.346 Octobercms October 1.0.347 Octobercms October 1.0.348 Octobercms October 1.0.349 Octobercms October 1.0.350 Octobercms October 1.0.351 Octobercms October 1.0.352 Octobercms October 1.0.353 Octobercms October 1.0.354 Octobercms October 1.0.355 Octobercms October 1.0.356 Octobercms October 1.0.357 Octobercms October 1.0.358 Octobercms October 1.0.359 Octobercms October 1.0.360 Octobercms October 1.0.361 Octobercms October 1.0.362 Octobercms October 1.0.363 Octobercms October 1.0.364 Octobercms October 1.0.365 Octobercms October 1.0.366 Octobercms October 1.0.367 Octobercms October 1.0.368 Octobercms October 1.0.369 Octobercms October 1.0.370 Octobercms October 1.0.371 Octobercms October 1.0.372 Octobercms October 1.0.373 Octobercms October 1.0.374 Octobercms October 1.0.375 Octobercms October 1.0.376 Octobercms October 1.0.377 Octobercms October 1.0.378 Octobercms October 1.0.379 Octobercms October 1.0.380 Octobercms October 1.0.381 Octobercms October 1.0.382 Octobercms October 1.0.383 Octobercms October 1.0.384 Octobercms October 1.0.385 Octobercms October 1.0.386 Octobercms October 1.0.387 Octobercms October 1.0.388 Octobercms October 1.0.389 Octobercms October 1.0.390 Octobercms October 1.0.391 Octobercms October 1.0.392 Octobercms October 1.0.393 Octobercms October 1.0.394 Octobercms October 1.0.395 Octobercms October 1.0.396 Octobercms October 1.0.397 Octobercms October 1.0.398 Octobercms October 1.0.399 Octobercms October 1.0.400 Octobercms October 1.0.401 Octobercms October 1.0.402 Octobercms October 1.0.403 Octobercms October 1.0.404 Octobercms October 1.0.405 Octobercms October 1.0.406 Octobercms October 1.0.407 Octobercms October 1.0.408 Octobercms October 1.0.409 Octobercms October 1.0.410 Octobercms October 1.0.411 Octobercms October 1.0.412 Octobercms October 1.0.413 Octobercms October 1.0.414 Octobercms October 1.0.415 Octobercms October 1.0.416 Octobercms October 1.0.417 Octobercms October 1.0.418 Octobercms October 1.0.419 Octobercms October 1.0.420 Octobercms October 1.0.421 Octobercms October 1.0.422 Octobercms October 1.0.423 Octobercms October 1.0.424 Octobercms October 1.0.425 Octobercms October 1.0.426 Octobercms October 1.0.427 Octobercms October 1.0.428 Octobercms October 1.0.429 Octobercms October 1.0.430 Octobercms October 1.0.431 Octobercms October 1.0.432 Octobercms October 1.0.433 Octobercms October 1.0.434 Octobercms October 1.0.435 Octobercms October 1.0.436 Octobercms October 1.0.437 Octobercms October 1.0.438 Octobercms October 1.0.439 Octobercms October 1.0.440 Octobercms October 1.0.441 Octobercms October 1.0.442 Octobercms October 1.0.443 Octobercms October 1.0.444 Octobercms October 1.0.445 Octobercms October 1.0.446 Octobercms October 1.0.447 Octobercms October 1.0.448 Octobercms October 1.0.449 Octobercms October 1.0.450 Octobercms October 1.0.451 Octobercms October 1.0.452 Octobercms October 1.0.453 Octobercms October 1.0.454 Octobercms October 1.0.455 Octobercms October 1.0.456 Octobercms October 1.0.457 Octobercms October 1.0.458 Octobercms October 1.0.459 Octobercms October 1.0.460 Octobercms October 1.0.461 Octobercms October 1.0.462 Octobercms October 1.0.463 Octobercms October 1.0.464 Octobercms October 1.0.465	147

Common Weakness Enumeration (CWE)

CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Common Attack Pattern Enumeration and Classification (CAPEC)

PHP Remote File Inclusion
In this pattern the attacker is able to load and execute arbitrary code remotely available from the application. This is usually accomplished through an insecurely configured PHP runtime environment and an improperly sanitized "include" or "require" call, which the user can then control to point to any web-accessible file. This allows attackers to hijack the targeted application and force it to execute their own instructions.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References