Lucene search
PRIOn knowledge basePRION:CVE-2017-16798HistoryNov 12, 2017 - 6:29 p.m.
Design/Logic Flaw
2017-11-1218:29:00
PRIOn knowledge base
www.prio-n.com
3
In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a “php” substring, which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions, as demonstrated by .phtml, .pht, .html, or .svg.
| CPE | Name | Operator | Version |
|---|---|---|---|
| cms_made_simple | eq | 2.2.3.1 |
Related
cvelist
cvelist
cve
cve
nvd
nvd
prion
prion
Design/Logic Flaw
2020-08-14 15:15:00
Design/Logic Flaw
2018-12-19 19:29:00
openvas
openvas
CMS Made Simple 2.2.3.1 Multiple Vulnerabilities
2017-11-13 00:00:00