PT-2020-12491 · Phproject · Phproject

Niebardzo · Published 2020-04-22 · Updated 2020-04-27 · CVE-2020-11011

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phproject versions prior to 1.7.8

Description The issue allows users with access to file uploads to execute arbitrary code.

Recommendations For versions prior to 1.7.8, update to version 1.7.8 to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-11011

GHSA-4J97-6W6Q-GXJX

Affected Products

Phproject

References · 4

• https://github.com/Alanaktion/phproject/commit/b49d642e035d835f824bd39babd964ec0e3a285f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11011 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11011 · Vendor Advisory
• https://github.com/Alanaktion/phproject/security/advisories/GHSA-4j97-6w6q-gxjx · Note