GitHub Advisoryadvisory · Packagist

GHSA-9r2j-rg24-fvpj FrozenNode Laravel-Administrator unrestricted file upload

HIGH Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2020-10963
Ecosystem
Packagist
Packages
frozennode/administrator
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2024-04-23

Affected packages

• Packagist frozennode/administrator: <= 5.0.12 (no fix yet)

Description

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via `admin/tips_image/image/file_upload` image upload with PHP content within a GIF image that has the `.php` extension. NOTE: this product is discontinued.

Related

Alias · CVE (1)

  • CVE-2020-10963 FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References