CoreCVE
Back

HIGH

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier

Published Oct 14, 2019

Description

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph and change the file's extension to p. Because of concatenation, the name is then treated as filename.php.) At the result, remote attackers can execute arbitrary PHP code.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-706

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Oct 14, 2019
Updated Aug 5, 2024
Reserved Oct 14, 2019
Link CVE-2019-17575
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-17575
Red Hat
Severity n/a
Public date n/a
Links CVE-2019-17575