CVE-2020-21356

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 1.2

Description: An information disclosure issue in the upload.php file of PopojiCMS leads to the physical path disclosure of the host. This occurs when the name variable equals "file" and is deleted during file uploads, specifically through the "upload.php" endpoint.

Recommendations: For PopojiCMS version 1.2, as a temporary workaround, consider restricting access to the upload.php file until a patch is available. Avoid using the name variable with the value "file" in the upload process to minimize the risk of exploitation.