PT-2020-3996 · Unknown · Responsive Filemanager

Published 2020-03-14 · Updated 2023-03-07 · CVE-2020-10567

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Responsive Filemanager versions through 9.14.0

Description: An issue was discovered in the ajax calls.php file, specifically in the save img action, where the name parameter lacks validation of the sent extension. This allows for the execution of PHP code if a legitimate JPEG image contains this code in its EXIF data and the .php extension is used in the name parameter. A remote attacker can exploit this issue by using a specially crafted JPEG image with malicious EXIF data containing PHP code.

Recommendations: For versions through 9.14.0, consider disabling the save img action in the config file as a temporary workaround until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04390

CVE-2020-10567

Affected Products

Responsive Filemanager

References · 7

• 🔥 https://github.com/trippo/ResponsiveFilemanager/issues/600 · Exploit
• https://osv.dev/vulnerability/CVE-2020-10567 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04390 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-10567 · Security Note
• http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html · Note
• https://cybersecurity-help.cz/vdb/SB2020033116 · Note
• https://t.me/cvenotify/1688 · Telegram Post