PT-2018-17785 · Php Scripts Mall · Php Scripts Mall Schools Alert Management Script

Publicado 2018-02-12 · Atualizado 2020-03-11 · CVE-2018-6860

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script version 2.0.2

Description The issue allows for Arbitrary File Upload and Remote Code Execution through a profile picture in the PHP Scripts Mall Schools Alert Management Script.

Recommendations For version 2.0.2, consider restricting the upload of files, especially for profile pictures, to prevent potential Arbitrary File Upload and Remote Code Execution until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-6860

Produtos afetados

Php Scripts Mall Schools Alert Management Script

Referências · 3

• 🔥 https://exploit-db.com/exploits/44011 · Exploit
• https://osv.dev/vulnerability/CVE-2018-6860 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6860 · Nota de Segurança