PT-2020-17398
CVE-2020-35709
·
تاريخ النشر
2020-12-25
·
تاريخ التحديث
2021-06-09
الوصف من
CVSS 3.1
4.9
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
bloofoxCMS version 0.5.2.1
Description
The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a "Content-Type: application/octet-stream" header.
Recommendations
For bloofoxCMS version 0.5.2.1, consider restricting access to the admin/index.php?mode=tools&page=upload URI to prevent arbitrary file uploads until a patch is available. As a temporary workaround, consider disabling the upload functionality in the admin panel to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾