CVE-2018-16370

Name of the Vulnerable Software and Affected Versions PESCMS Team version 2.2.1

Description The issue allows attackers to upload and execute arbitrary PHP code. This can be achieved by uploading a ZIP archive containing a .php file through the "/Public/?g=Team&m=Setting&a=upgrade" API endpoint.

Recommendations For PESCMS Team version 2.2.1, consider disabling the upgrade functionality in the Team module as a temporary workaround until a patch is available. Restrict access to the "/Public/?g=Team&m=Setting&a=upgrade" endpoint to minimize the risk of exploitation.