CVE-2022-46604 - An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution

Back Back to CVE browser

HIGH

An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution

Published Feb 2, 2023

8.8

HIGH

CVSS 3.1

EPSS 8.63%

Description

An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (4)

Link	Providers	Tags
http://packetstormsecurity.com/files/171720/Responsive-FileManager-9.9.5-Remote-Shell-Upload.html
https://github.com/trippo/ResponsiveFilemanager/blob/v9.9.5/filemanager/execute.php		Third Party Advisory
https://github.com/trippo/ResponsiveFilemanager/blob/v9.9.6/changelog.txt		Release NotesThird Party Advisory
https://medium.com/%40_sadshade/file-extention-bypass-in-responsive-filemanager-9-5-5-leading-to-rce-authenticated-3290eddc54e7