CVE-2018-20166
Summary
| CVE | CVE-2018-20166 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-01-02 18:29:00 UTC |
| Updated | 2019-01-31 16:33:00 UTC |
| Description | A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed case, such as the .pHp extension. |
Risk And Classification
Problem Types: CWE-434
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Rukovoditel | Rukovoditel | 2.3.1 | All | All | All |
| Application | Rukovoditel | Rukovoditel | 2.3.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Rukovoditel Project Management CRM 2.3.1 - Remote Code Execution (Metasploit) - PHP webapps Exploit | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| Pentest Blog - Self-Improvement to Ethical Hacking | MISC | pentest.com.tr | Exploit, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.