Skip to main content

Unrestricted Upload of File with Dangerous Type

CVE-2024-8295

High
9.8/10

Summary

A vulnerability has been found in feehi/cms package, and it was classified as critical. This vulnerability affects the function "createBanner" of the file "/admin/index.php?r=banner%2Fbanner-create". The manipulation of the argument "BannerForm[img]" leads to Unrestricted Upload of File with Dangerous Type vulnerability. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-434 - Unrestricted Upload of File with dangerous type

'Unrestricted file upload with dangerous type' attacks involve an attacker uploading or transferring files of dangerous types to the server. The severity of such an attack depends upon the execution mechanism and the storage location of the uploaded file. Thus, it may range from simple defacement to arbitrary file execution, and complete system takeover.

References

Advisory Timeline

  • Published