CVE-2019-11447: Unrestricted Upload of File with Dangerous Type

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

PT-2019-12312

Name of the Vulnerable Software and Affected Versions CutePHP CuteNews version 2.1.2 Description An issue allows an attacker to infiltrate the server through the avatar upload process in the profile area via the "index.php?mod=main&opt=personal" endpoint, by exploiting the avatar file field. The...