CVE-2018-16974

Publicada em 12 set 2018 · Atualizada em 05 ago 2024

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 3.6%

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).

Produtos afetados

n/a · n/a

Referências

https://github.com/jbroadway/elefant/commit/49ba8cc24e9f009ce30d2c2eb9eefeb9be4ce1d0 https://github.com/jbroadway/elefant/issues/287 https://github.com/jbroadway/elefant/releases/tag/elefant_2_0_7_stable