HIGH
An issue was discovered in CutePHP CuteNews 2.1.2
Published Apr 22, 2019
8.8
HIGHCVSS 3.0
EPSS 52.27%
Description
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
Affected products
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
- http://packetstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.html x_refsource_MISC
- http://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html x_refsource_MISCExploitThird Party Advisory
- https://www.exploit-db.com/exploits/46698/ exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
| Link | Providers | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.html | x_refsource_MISC | |
| http://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html | x_refsource_MISCExploitThird Party Advisory | |
| https://www.exploit-db.com/exploits/46698/ | exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 22, 2019
Updated Aug 4, 2024
Reserved Apr 21, 2019
Link CVE-2019-11447
CISA Vulnrichment
Updated n/a