Unrestricted file upload

2020-09-0420:15:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.7%

JSON

Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.

CPENameOperatorVersion
concrete_cmsle8.5.2

CPE	Name	Operator	Version
	concrete_cms	le	8.5.2

References

hackerone.com/reports/768322