CVE-2020-35734 | BDVDB-2026-149183 Detail

Description#

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://batflat.org/en/changelog
https://secator.pl/index.php/2021/02/15/batflat-v-1-3-6-authenticated-remote-code-execution-public-disclosure/
https://github.com/sruupl/batflat/issues/98
http://packetstormsecurity.com/files/161457/Batflat-CMS-1.3.6-Remote-Code-Execution.html

Exploit#

No public exploit known

History#

Version 12021-02-15Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.