CVE-2014-9567

EPSS 43.3%

Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.

Affected products

n/a · n/a

public PoCs found — 5

cve_referencepacketstormsecurity.com/files/129759/ProjectSend-Arbitrary-File-Upload.htmlunverified cve_referencewww.exploit-db.com/exploits/35424unverified cve_referencewww.exploit-db.com/exploits/35660unverified exploitdbwww.exploit-db.com/exploits/35660unverified exploitdbwww.exploit-db.com/exploits/35424unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://osvdb.org/show/osvdb/116469 http://packetstormsecurity.com/files/129759/ProjectSend-Arbitrary-File-Upload.html https://exchange.xforce.ibmcloud.com/vulnerabilities/99548 http://www.exploit-db.com/exploits/35424 http://www.exploit-db.com/exploits/35660