CVE-2019-11447
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
57Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.
ssvc Actepss 53%
de la publicación al armael mismo día
Publicada en NVD22 abr
1ª PoC15 abr
VulnCheck+602d
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
Productos afectados
n/a · n/aPoCs públicas encontradas — 19✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48800exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46698githubgithub.com/thewhiteh4t/cve-2019-11447★ 9githubgithub.com/CRFSlick/CVE-2019-11447-POC★ 1githubgithub.com/khuntor/CVE-2019-11447-EXP★ 1githubgithub.com/substing/CVE-2019-11447_reverse_shell_upload★ 0githubgithub.com/ColdFusionX/CVE-2019-11447_CuteNews-AvatarUploadRCE★ 0githubgithub.com/mt-code/CVE-2019-11447★ 0githubgithub.com/capivara-research/WordPress-Path-Traversal-CVE-2019-11447★ 0vulncheckvulncheck.com/xdb/94c16e608e29no verificadovulncheckvulncheck.com/xdb/f03b1de670c3no verificadovulncheckvulncheck.com/xdb/19ee03e9739bno verificadocve_referencepacketstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/3b15909793d5no verificadocve_referencewww.exploit-db.com/exploits/46698/no verificadovulncheckvulncheck.com/xdb/3d07c35c7d7cno verificadovulncheckvulncheck.com/xdb/553b51ae82c7no verificadovulncheckvulncheck.com/xdb/049d322175e7no verificadovulncheckvulncheck.com/xdb/4d7537d97b39no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.