CVE-2019-17536

CVSS 9.9 CRITICALEPSS 2.3%

Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.

CVSS:3.0/AC:L/AV:N/A:L/C:H/I:H/PR:L/S:C/UI:N

Affected products

n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/GilaCMS/gila/pull/49 https://rastating.github.io/gila-cms-upload-filter-bypass-and-rce/