CVE-2020-23972

Name of the Vulnerable Software and Affected Versions Joomla Component GMapFP versions J3.5 and J3.5free

Description The issue allows an attacker to access the upload function without authenticating to the application. It also enables the upload of files due to unrestricted file uploads. This can be bypassed by changing the content-type and name file to use double extensions.

Recommendations For Joomla Component GMapFP versions J3.5 and J3.5free, consider restricting access to the upload function to authenticated users only and implement proper validation for uploaded files to prevent bypassing by changing the content-type and name file. As a temporary workaround, consider disabling the upload function until a proper fix is available.