PT-2019-18970 · Unknown · Upload-Image-With-Ajax

Larry W. Cashdollar · Publicado 2019-12-23 · Atualizado 2020-01-02 · CVE-2019-8293

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions upload-image-with-ajax version 1.0

Description A logic error in the code allows arbitrary files to be uploaded to the web root, enabling code execution.

Recommendations For upload-image-with-ajax version 1.0, consider disabling the file upload functionality until a patch is available to prevent arbitrary file uploads and potential code execution.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-8293

Produtos afetados

Upload-Image-With-Ajax

Referências · 4

• 🔥 http://openwall.com/lists/oss-security/2019/12/23/2 · Exploit
• https://github.com/abcprintf/upload-image-with-ajax/commit/71436ba5102010397519d4b25ea57591cfb4974c · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-8293 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-8293 · Aviso do Fabricante