PT-2017-12227 · Projeqtor · Projeqtor

Publicado 2017-07-31 · Atualizado 2017-08-09 · CVE-2017-11760

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjeQtOr versions prior to 6.3.2

Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data. This can be achieved by uploading the malicious file as an image within the description text area.

Recommendations For versions prior to 6.3.2, update to version 6.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the uploadImage.php file to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-11760

Produtos afetados

Projeqtor

Referências · 3

• https://track.projeqtor.org/view/main.php?directAccess=true&objectClass=Ticket&objectId=2884 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11760 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11760 · Aviso do Fabricante