CVE-2020-10567

Published: Mar 14, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)

Affected (1)

Products: Tecrail: Responsive Filemanager

1 product

Responsive Filemanager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Tecrail Responsive Filemanager	Up to 9.14.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html

Source: cve@mitre.org

https://github.com/trippo/ResponsiveFilemanager/issues/600

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/trippo/ResponsiveFilemanager/issues/600

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.