PT-2019-10011

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 2.3.1 Description: A file-upload issue exists, allowing users to upload PHP content by exploiting a weakness in extension checking. The "index.php?module=configuration/save" endpoint accepts uploads if the first few...

CVE-2018-20166: Unrestricted Upload of File with Dangerous Type

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...