GHSA-r342-vjc4-wrmj

ghsaUSosv

Craft CMS PHP Code Injection Vulnerability

view advisory published 2022-05-13Licence: CC-BY-4.0

Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-3814US	high8.8	1.88% (79th)	—	2018-01-01
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg fil…

references

External citations — patches, advisories, analysis.

https://github.com/Snowty/myCVE/blob/master/CraftCMS-2.6.3000/README.mdWEB
https://github.com/craftcms/cmsPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2018-3814ADVISORY
https://web.archive.org/web/20170612231205/http://0day5.com/archives/4122WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan