CVE-2018-11392

Name of the Vulnerable Software and Affected Versions Jigowatt PHP Login & User Management versions prior to 4.1.1

Description The issue allows any remote authenticated user to upload .php files to the web server via a profile avatar field in the /classes/profile.class.php file. This results in arbitrary code execution by requesting the .php file.

Recommendations For versions prior to 4.1.1, update to version 4.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the profile avatar field or disabling the profile.class.php file until a patch is available. Avoid using the profile avatar field in the affected API endpoint until the issue is resolved.