PT-2017-5848

Name of the Vulnerable Software and Affected Versions: X2Engine X2CRM versions prior to 4.0 Description: The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the ProfileController::actionUploadPhoto method, and then accessing it via a...

CVE-2014-2664: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the ProfileController::actionUploadPhoto method in protected/controllers/ProfileController.php in X2Engine X2CRM before 4.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct...