sartlabs / 0days Goto Github PK

Hello, Patrick Schmalstig / PDStig here (a lead dev of Composr CMS).

You might have already seen this but in case you have not, Chris Graham explained why the reported CVE vulnerability for Composr CMS CVE-2021-46360 is not a vulnerability.

The full news article is here: Clarifying the nature of administrator accounts. In short:

1. An "Administrator" by Composr's standards is someone who should have full and complete access to the code. Therefore, it is not a vulnerability that an administrator can remove .htaccess files and upload PHP files; it's by design.
2. Composr tries not to rely on / require FTP and SSH for full functionality and harmony (e.g. it allows you to do anything and everything via a web interface), thus why admins have full code access.
3. Generally, only webmasters should have admin privileges.