CVE-2017-7570

Published: Apr 7, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

PivotX 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by performing an upload with a safe file extension (such as .jpg) and then invoking the duplicate function to change to the .php extension.

Affected (1)

Products: Pivotx: Pivotx

Pivotx

1 product

Pivotx

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pivotx Pivotx	Version 2.3.11

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://gist.github.com/X1nda/749b6aac6e080624d9f8ec81321335df

Source: cve@mitre.org

ExploitThird Party Advisory

https://gist.github.com/X1nda/749b6aac6e080624d9f8ec81321335df

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.