Posted by Ron E on Sep 03 Description

Flextype CMS v1.0.0-alpha.3 contains a stored code execution vulnerability

caused by the interaction between globally processed entry expressions, the

mutable registry object exposed to expressions, and the PHP entry directive.

Attacker-controlled entry fields are automatically processed as expressions

during entry retrieval. The expression environment exposes the

application's mutable registry() object, allowing an expression...