Insufficient file checks in m1k1o/blog
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.5epss 9.9%
from disclosure to weapon104 days
Published on NVDFeb 8
1st PoC+104d
exploitation probability
9.9%top 5% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom*` and `image*` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
m1k1o · blogpublic PoCs found — 2
exploitdbwww.exploit-db.com/exploits/50943unverifiedcve_referencepacketstormsecurity.com/files/167235/m1k1os-Blog-1.3-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.