← back
CVE-2020-25790

CVE-2020-25790

EPSS 15.6%
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2
Affected products
n/a · n/a
public PoCs found — 4
githubgithub.com/7Mitu/CVE-2020-25790★ 5cve_referencepacketstormsecurity.com/files/159503/Typesetter-CMS-5.1-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/159615/Typesetter-CMS-5.1-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/48906unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/159503/Typesetter-CMS-5.1-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/159615/Typesetter-CMS-5.1-Remote-Code-Execution.htmlhttp://seclists.org/fulldisclosure/2020/Oct/11https://github.com/Typesetter/Typesetter/issues/674