CVE-2017-11326
HighSummary
An issue was discovered in Tilde CMS version 1.0.1 that allows bypassing the implemented restrictions on arbitrary file upload via filename manipulation with .php extension.
Risk Assessment
The organization may be exposed to unauthorized uploads of malicious files, potentially leading to serious security breaches.
Recommendation
It is recommended to update Tilde CMS to the latest version and implement additional verification mechanisms for uploaded files.
Other vulnerabilities in Tilde CMS 1.0.1
See all- CVE-2017-11325High
An issue was discovered in Tilde CMS version 1.0.1 that allows arbitrary files to be read via a file=../ attack on actionphp/download.File.php.
- CVE-2017-11324Critical
An issue was discovered in Tilde CMS version 1.0.1 due to missing escaping of the backtick character, leading to SQL Injection vulnerability in the SELECT query in class.SystemAction.php.
Original NVD description (English source)
An issue was discovered in Tilde CMS 1.0.1. It is possible to bypass the implemented restrictions on arbitrary file upload via a filename.+php manipulation.