PHPKB Multi-Language 9 image-upload.php Code Execution

Exploit Title: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution Google Dork: N/A Date: 2020-03-15 Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/ Software Link: https://www.knowledgebase-script.com/pricing.php Version:...

Chadha PHPKB path traversal vulnerability (CNVD-2020-18323)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A path traversal vulnerability exists in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9. An attacker can...

Chadha PHPKB path traversal vulnerability (CNVD-2020-18319)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A path traversal vulnerability exists in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9. An attacker...

CVE-2020-10458

Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence ../ via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service...

Directory traversal

admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory...

PT-2020-12056

Name of the Vulnerable Software and Affected Versions Chadha PHPKB Standard Multi-Language version 9 Description The issue allows remote attackers to achieve code execution by uploading a .php file in the admin/js/ directory. This is made possible through the admin/imagepaster/image-upload.php...

CVE-2020-10458: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in admin/imagepaster/operations.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete any folder on the webserver using a dot-dot-slash sequence ../ via the GET parameter crdir, when the GET parameter action is set to df, causing a Denial of Service...

CVE-2020-10386: Unrestricted Upload of File with Dangerous Type

admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory...

CVE-2020-10457: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in admin/imagepaster/image-renaming.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to rename any file on the webserver using a dot-dot-slash sequence ../ via the POST parameter imgName for the new name and imgUrl for the current file to be renamed...