CVE-2019-11447
57Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.
ssvc Actepss 53%
da publicação à arma0 dias
Publicada no NVD22 de abr.
1ª PoC15 de abr.
VulnCheck+602d
probabilidade de exploração
53%top 1% das CVEs
exploração observada
simVulnCheck
18 exploit(s) público(s)
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
Produtos afetados
n/a · n/aPoCs públicas encontradas — 18✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46698exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/48800githubgithub.com/thewhiteh4t/cve-2019-11447★ 9githubgithub.com/CRFSlick/CVE-2019-11447-POC★ 1githubgithub.com/khuntor/CVE-2019-11447-EXP★ 1githubgithub.com/substing/CVE-2019-11447_reverse_shell_upload★ 0githubgithub.com/ColdFusionX/CVE-2019-11447_CuteNews-AvatarUploadRCE★ 0githubgithub.com/mt-code/CVE-2019-11447★ 0vulncheckvulncheck.com/xdb/f03b1de670c3não verificadovulncheckvulncheck.com/xdb/19ee03e9739bnão verificadovulncheckvulncheck.com/xdb/94c16e608e29não verificadocve_referencewww.exploit-db.com/exploits/46698/não verificadovulncheckvulncheck.com/xdb/3d07c35c7d7cnão verificadovulncheckvulncheck.com/xdb/3b15909793d5não verificadovulncheckvulncheck.com/xdb/553b51ae82c7não verificadovulncheckvulncheck.com/xdb/049d322175e7não verificadovulncheckvulncheck.com/xdb/4d7537d97b39não verificadocve_referencepacketstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.