CVE-2019-9572: Unrestricted Upload of File with Dangerous Type

SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...

PT-2019-19717

Name of the Vulnerable Software and Affected Versions SchoolCMS version 2.3.1 Description The issue allows for file upload via the theme upload feature at "admin.php?m=admin&c=theme&a=upload" by exploiting the mishandling in the Upload function of the ThemeController.class.php file. This can be...