CVE Catalog
CVE-2017-14346
CriticalSummary
The upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.
Risk Assessment
The organization may be exposed to malicious attacks that allow unauthorized code execution on the server, potentially leading to system compromise.
Recommendation
It is recommended to impose restrictions on the types of files that can be uploaded and to implement additional verification and security mechanisms for uploaded files.
Original NVD description (English source)
upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file upload and PHP code execution by using the image/jpeg, image/pjpeg, image/png, or image/gif content type for a .php file.