PT-2019-7548 · Serendipity · Serendipity

Publicado 2019-05-24 · Atualizado 2019-05-29 · CVE-2016-10752

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serendipity version 2.0.3

Description The issue allows remote attackers to upload and execute arbitrary PHP code due to mishandling of an extensionless filename during a rename. This can be demonstrated by using "php" as a filename.

Recommendations For Serendipity version 2.0.3, consider disabling the serendipity moveMediaDirectory function until a patch is available to prevent the upload and execution of arbitrary PHP code.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2016-10752

Produtos afetados

Serendipity

Referências · 5

• https://blog.ripstech.com/2016/serendipity-from-file-upload-to-code-execution · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10752 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-10752 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10752 · Nota
• https://demo.ripstech.com/projects/serendipity_2.0.3 · Nota