CVE-2014-2664

Publicada el 17 oct 2017 · Actualizada el 06 ago 2024

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 2.9%

Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

Productos afectados

n/a · n/a

Referencias

http://karmainsecurity.com/KIS-2014-04 http://secunia.com/advisories/57315 https://exchange.xforce.ibmcloud.com/vulnerabilities/92169 https://secuniaresearch.flexerasoftware.com//secunia_research/2014-4 http://www.securityfocus.com/bid/66506/discuss