CVE-2019-11447
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
57Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 53%
from disclosure to weaponsame day
Published on NVDApr 22
1st PoCApr 15
VulnCheck+602d
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
Affected products
n/a · n/apublic PoCs found — 19✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48800exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46698githubgithub.com/thewhiteh4t/cve-2019-11447★ 9githubgithub.com/CRFSlick/CVE-2019-11447-POC★ 1githubgithub.com/khuntor/CVE-2019-11447-EXP★ 1githubgithub.com/substing/CVE-2019-11447_reverse_shell_upload★ 0githubgithub.com/ColdFusionX/CVE-2019-11447_CuteNews-AvatarUploadRCE★ 0githubgithub.com/mt-code/CVE-2019-11447★ 0githubgithub.com/capivara-research/WordPress-Path-Traversal-CVE-2019-11447★ 0vulncheckvulncheck.com/xdb/94c16e608e29unverifiedvulncheckvulncheck.com/xdb/f03b1de670c3unverifiedvulncheckvulncheck.com/xdb/19ee03e9739bunverifiedcve_referencepacketstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/3b15909793d5unverifiedcve_referencewww.exploit-db.com/exploits/46698/unverifiedvulncheckvulncheck.com/xdb/3d07c35c7d7cunverifiedvulncheckvulncheck.com/xdb/553b51ae82c7unverifiedvulncheckvulncheck.com/xdb/049d322175e7unverifiedvulncheckvulncheck.com/xdb/4d7537d97b39unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.