CVE-2016-10756

2019-05-2417:41:16

mitre

www.cve.org

8.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.7%

JSON

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/upload_main.php can be used for the upload itself.

References

blog.ripstech.com/2016/kliqqi-from-cross-site-request-forgery-to-code-execution/

demo.ripstech.com/projects/kliqqi_3.0.0.5