Описание
UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution through maliciously crafted avatar uploads.
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:ulicms:ulicms:2023.1:*:*:*:*:*:*:*
EPSS
Процентиль: 53%
0.00305
Низкий
8.8 High
CVSS3
Дефекты
CWE-434
Связанные уязвимости
CVSS3: 8.8
github
около 2 месяцев назад
UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution through maliciously crafted avatar uploads.
EPSS
Процентиль: 53%
0.00305
Низкий
8.8 High
CVSS3
Дефекты
CWE-434