CVE-2014-1683
CVE-2014-1683 is a medium-severity vulnerability in Skybluecanvas with a CVSS 2.0 base score of 6.8. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-134.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.8)
- EPSS exploit prediction: 31% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-134
- Affected product: Skybluecanvas
- Published:
- Last modified:
Description
The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
Frequently asked questions
- What is CVE-2014-1683?
- The bashMail function in cms/data/skins/techjunkie/fragments/contacts/functions.php in SkyBlueCanvas CMS before 1.1 r248-04, when the pid parameter is 4, allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) name, (2) email, (3) subject, or (4) message parameter to index.php.
- How severe is CVE-2014-1683?
- CVE-2014-1683 has a CVSS 2.0 base score of 6.8, rated medium severity.
- Is CVE-2014-1683 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-1683?
- CVE-2014-1683 affects Skybluecanvas. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2014-1683?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2014-1683 published?
- CVE-2014-1683 was published on 2014-01-29 and last updated on 2026-06-17.
References
- http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html
- http://seclists.org/fulldisclosure/2014/Jan/159
- http://secunia.com/advisories/56646
- http://www.exploit-db.com/exploits/31183
- http://www.exploit-db.com/exploits/31432
- http://www.securityfocus.com/bid/65129
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90670
Affected products (1)
- cpe:2.3:a:skybluecanvas:skybluecanvas:*:*:*:*:*:*:*:*
More vulnerabilities in Skybluecanvas
- CVE-2009-2115 — Medium (CVSS 6.8): admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an…
- CVE-2009-2114 — Medium (CVSS 4.3): Multiple cross-site scripting (XSS) vulnerabilities in admin.php in SkyBlueCanvas 1.1 r237 allow remote attackers to…
- CVE-2009-2116 — Medium (CVSS 4.0): Directory traversal vulnerability in admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to…
All CVEs affecting Skybluecanvas →
Other CWE-134 vulnerabilities
- CVE-2012-1851 — Critical (CVSS 10.0): Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,…
- CVE-2012-0242 — Critical (CVSS 10.0): Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary…
- CVE-2011-2475 — Critical (CVSS 10.0): Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server…
- CVE-2011-1568 — Critical (CVSS 10.0): Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and…
- CVE-2010-4235 — Critical (CVSS 10.0): Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server…
- CVE-2011-0270 — Critical (CVSS 10.0): Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows…