PT-2019-19419 · Schoolcms · Schoolcms

Publicado 2019-02-26 · Atualizado 2019-02-26 · CVE-2019-9181

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SchoolCMS version 2.3.1

Description The issue allows for file upload via the logo upload feature at "admin.php?m=admin&c=site&a=save" by manipulating the file extension and content type. Specifically, an attacker can use the .jpg extension, change the Content-Type to "image/php", and place PHP code after the JPEG data. This enables the execution of arbitrary PHP code.

Recommendations For SchoolCMS version 2.3.1, consider disabling the logo upload feature at "admin.php?m=admin&c=site&a=save" until a patch is available to prevent arbitrary PHP code execution. Restrict access to the save action in the site controller to minimize the risk of exploitation. Avoid using the logo upload feature with files that have the .jpg extension and "image/php" Content-Type until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-9181

Produtos afetados

Schoolcms

Referências · 3

• 🔥 http://iwantacve.cn/index.php/archives/125 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9181 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9181 · Nota de Segurança