PT-2020-16879
CVE-2020-27956
·
تاريخ النشر
2020-10-28
·
تاريخ التحديث
2020-11-03
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
SourceCodester Car Rental Management System version 1.0
Description
The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the admin/assets/uploads/ directory, which is under the web root, via the admin/index.php?page=manage car endpoint.
Recommendations
For SourceCodester Car Rental Management System version 1.0, consider restricting access to the Upload Image component to prevent arbitrary file uploads until a patch is available. As a temporary workaround, restrict write access to the admin/assets/uploads/ directory to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾