[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)
Maian Pal 2.1 image uploads lack an extension allow-list, enabling PHP code execution.
Stories per day · 30 days
2 RSS
7 stories, newest first · one card per story
Stories tagged #cwe-434
[0day-rubbish] Maian Cart 3.8 addBanners unrestricted banner upload to PHP webshell and administrator command execution (7.2 primary, PR:H)
Maian Cart 3.8 allows unrestricted banner uploads that become PHP webshells for administrator command execution.
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Maintainers will not fix a Moodle 3.9.2 upload bypass to RCE unless current LTS versions are affected.
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Oss-security thread discusses a Moodle 3.9.2 authenticated file-upload validation bypass (CWE-434) enabling RCE under misconfiguration.
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Poster questions a CVE for an authenticated Moodle 3.9.2 upload bypass that needs misconfiguration for RCE.
Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration
Researcher reports an authenticated Moodle 3.9.2 file-upload bypass that can yield RCE if misconfigured.
[0day-rubbish] LCDS Laquis SCADA Unauthenticated /uploade.html file write chained with CMDEXT*.DLL autoload (9.8)
Unauthenticated file upload in LCDS Laquis SCADA chains with DLL autoload for code execution, CVSS 9.8.