CVE-2020-24949

Опубликовано: 03 сент. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Высокий

Описание

Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).

Ссылки

http://packetstormsecurity.com/files/162852/PHPFusion-9.03.50-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/php-fusion/PHP-Fusion/issues/2312
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/162852/PHPFusion-9.03.50-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://github.com/php-fusion/PHP-Fusion/issues/2312
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:php-fusion:php-fusion:9.03.50:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.8889

Высокий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-vrxg-55c7-pjh6

github

больше 3 лет назад