CVE-2018-8972
Creditwest Bank CMS Project (aka CWCMS) through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary P…
Published: 2018-03-24 · CVSS: Unscored
Creditwest Bank CMS Project (aka CWCMS) through 2017-07-28 has CSRF in the functionality for updating the site configuration, which allows remote attackers to inject arbitrary PHP code, as demonstrated by a PHP shell that calls eval on request parameters.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7