PT-2019-15931 · Kcfinder · Roxy Fileman

Publicado 2019-12-16 · Atualizado 2019-12-23 · CVE-2019-19731

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Roxy Fileman version 1.4.5

Description The issue allows a remote attacker to perform path traversal, enabling them to write uploaded files to arbitrary locations using the RENAMEFILE action. This can be exploited for code execution by uploading a specially crafted Windows shortcut file and writing it to the Startup folder, as the blacklist of file extensions is incomplete, permitting Windows shortcut files to be uploaded.

Recommendations For version 1.4.5, consider restricting access to the RENAMEFILE action until a patch is available, and ensure that Windows shortcut files are properly blocked from being uploaded to prevent code execution.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-19731

Produtos afetados

Roxy Fileman

Referências · 5

• 🔥 https://exploit-db.com/exploits/47777 · Exploit
• 🔥 http://packetstormsecurity.com/files/155666/Roxy-Fileman-1.4.5-For-.NET-Directory-Traversal.html · Exploit
• http://roxyfileman.com/download · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-19731 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19731 · Aviso do Fabricante