PT-2017-12227 · Projeqtor · Projeqtor

Published 2017-07-31 · Updated 2017-08-09 · CVE-2017-11760

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ProjeQtOr versions prior to 6.3.2

Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data. This can be achieved by uploading the malicious file as an image within the description text area.

Recommendations For versions prior to 6.3.2, update to version 6.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the uploadImage.php file to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-11760

Affected Products

Projeqtor

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-11760 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11760 · Vendor Advisory
• https://track.projeqtor.org/view/main.php?directAccess=true&objectClass=Ticket&objectId=2884 · Note