CVE-2019-15954 EXPLOIT
9.9
CRITICAL · CVSS 3.1 · EPSS 78.7% (pctl 100)
Patch early
A public exploit exists.
Description
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
Scoring
| CVSS | 9.9 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 78.69% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-862 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-09-05 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| totaljs | total.js cms |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Total.js CMS 12 - Widget JavaScript Code Injection (Metasploit) | 2019-10-22 |
References
- http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html
- https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
- https://seclists.org/fulldisclosure/2019/Sep/5
- http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html
- https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
- https://seclists.org/fulldisclosure/2019/Sep/5
→ the Explorer · watch your stack · NVD