$ cve CVE-2012-1200 JSON

CVE-2012-1200 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 2.6% (pctl 85)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	2.61% — more likely to be exploited than 85% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2012-02-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
nova-cms	nova cms

Public exploits

Source	Title	Date
exploit-db	Nova CMS - '/administrator/modules/moduleslist.php?id' Remote File Inclusion	2012-02-11
exploit-db	Nova CMS - '/optimizer/index.php?fileType' Remote File Inclusion	2012-02-11
exploit-db	Nova CMS - '/includes/function/gets.php?Filename' Remote File Inclusion	2012-02-11
exploit-db	Nova CMS - '/includes/function/usertpl.php?conf[blockfile]' Remote File Inclusion	2012-02-11

References

→ the Explorer · watch your stack · NVD