PT-2018-11088
CVE-2018-12263
·
Publicado
2018-06-13
·
Atualizado
2020-02-20
Descrição por
CVSS 3.1
8.8
AltaMétricasAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
portfolioCMS version 1.0.5
Description
The issue allows the upload of arbitrary .php files via the "admin/portfolio.php?newpage=true" API endpoint. This could potentially lead to unauthorized code execution.
Recommendations
For portfolioCMS version 1.0.5, consider restricting access to the "admin/portfolio.php?newpage=true" API endpoint until a patch is available. As a temporary workaround, disabling the file upload functionality in the admin interface may help minimize the risk of exploitation.
Explorabilidade
Correção
Impactos
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾