CVE-2021-28132

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

Remote code execution

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

CVE-2021-28132

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

CVE-2021-28132

CVE-2021-28132 affects LUCY Security Awareness Software up to version 4.7.x. The root cause is in the Migration Tool (Support section) which permits uploading PHP files inside a system.tar.gz. The uploaded PHP can be accessed via a public/system/static URI, enabling unauthenticated remote code ex...

CVE-2021-28132: Improper Neutralization of Special Elements used in an OS Command

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

PT-2021-17764

Name of the Vulnerable Software and Affected Versions: LUCY Security Awareness Software versions 4.7.x and earlier Description: The issue allows unauthenticated remote code execution due to the Migration Tool in the Support section permitting the upload of .php files within a system.tar.gz file...