Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Rukovoditel Unrestricted Upload of File with Dangerous Type Vulnerability - CVE-2018-20166 - Vulnerability Database
Rukovoditel

Rukovoditel Unrestricted Upload of File with Dangerous Type Vulnerability - CVE-2018-20166

High
Reference: CVE-2018-20166
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2018-20166
Title: Rukovoditel Unrestricted Upload of File with Dangerous Type Vulnerability
Overview:

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.phpmoduleconfiguration/save allows the user to upload a background image and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data and the filename ends in quot.phpquot with mixed case such as the .pHp extension.