CVE-2015-5457

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.3.11

Description The issue allows remote attackers to execute arbitrary code by uploading a crafted file. This is possible because the software does not validate the new file extension when renaming a file with multiple extensions. For example, a file named foo.php.php can be used to demonstrate this issue.

Recommendations For versions prior to 2.3.11, update to version 2.3.11 or later to resolve the issue.