CVE-2017-11760

Name of the Vulnerable Software and Affected Versions ProjeQtOr versions prior to 6.3.2

Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data. This can be achieved by uploading the malicious file as an image within the description text area.

Recommendations For versions prior to 6.3.2, update to version 6.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the uploadImage.php file to minimize the risk of exploitation.