Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Moxa SoftCMS, en versiones 1.3 y anteriores, es susceptible a una condición de desbordamiento de búfer que podría cerrarse inesperadamente o permitir la ejecución remota de código. Moxa lanzó la versión 1.4 de SoftCMS el 1 de junio de 2015 para abordar esta vulnerabilidad.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Moxa SoftCMS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within processing of the strIP parameter of the setUserInfoData method of the VLCPlugin control. The IP address string is copied to a fixed-length heap buffer without a length validation. An attacker can leverage this vulnerability to gain code execution under the context of the process.
