Unrestricted file upload in PivotX - CVE-2017-8402
Published: May 31, 2017 / Updated: June 1, 2017
Vulnerability identifier: #VU6850
CSH Severity: Medium
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2017-8402
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.
The vulnerability exists due to insufficient validation of the uploaded files in "/pivotx/fileupload.php" script. A remote authenticated attacker can upload a specially crafted .htaccess files on the system and use it to execute arbitrary PHP code.
Successful exploitation may allow an attacker to compromise vulnerable website.
The vulnerability exists due to insufficient validation of the uploaded files in "/pivotx/fileupload.php" script. A remote authenticated attacker can upload a specially crafted .htaccess files on the system and use it to execute arbitrary PHP code.
Successful exploitation may allow an attacker to compromise vulnerable website.
Affected software
PivotX
How to mitigate CVE-2017-8402
Install update from vendor's repository.