PT-2019-11965 · Flatcore · Flatcore

Geeeez · Publicado 2019-03-30 · Atualizado 2019-04-01 · CVE-2019-10652

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions flatCore version 1.4.7

Description An issue was discovered that allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature in acp/acp.php.

Recommendations For flatCore version 1.4.7, consider disabling the addons feature or restricting file uploads to prevent exploitation until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-10652

Produtos afetados

Flatcore

Referências · 3

• 🔥 https://github.com/flatCore/flatCore-CMS/issues/38 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10652 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-10652 · Nota de Segurança