CVE-2020-24949

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50

Description The issue allows an authenticated user to send a crafted request to the server, enabling them to perform remote command execution. This is a result of a privilege escalation flaw in the downloads/downloads.php file.

Recommendations For PHP-Fusion version 9.03.50, as a temporary workaround, consider restricting access to the downloads/downloads.php file until a patch is available. Avoid using this file for downloads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.