Lucene search
PRIOn knowledge basePRION:CVE-2020-10567HistoryMar 14, 2020 - 2:15 p.m.
Code injection
2020-03-1414:15:00
PRIOn knowledge base
www.prio-n.com
3
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)
| CPE | Name | Operator | Version |
|---|---|---|---|
| responsive_filemanager | le | 9.14.0 |
Related
cvelist
cvelist
CVE-2020-10567
2020-03-14 00:00:00
nvd
nvd
CVE-2020-10567
2020-03-14 14:15:11
osv
osv
CVE-2020-10567
2020-03-14 14:15:11
zdt
zdt
ZwiiCMS 12.2.04 Remote Code Execution Exploit
2023-03-07 00:00:00
exploitdb
exploitdb
ZwiiCMS 12.2.04 - Remote Code Execution (Authenticated)
2024-06-14 00:00:00
cve
cve
CVE-2020-10567
2020-03-14 14:15:11
packetstorm
packetstorm
ZwiiCMS 12.2.04 Remote Code Execution
2023-03-07 00:00:00