ID:5850 - Exploit for Arbitrary file upload in Enterprise Building Management System and Proton Building Management System - CVE-2019-7274

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to to the absence of file extension validation when uploading files through the badge image upload script. A remote non-authenticated attacker can upload files with arbitrary extensions into a directory within application’s web root and execute them with privileges of the web server.

Remediation