CVE-2017-14958
HighSummary
lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.
Risk Assessment
The organization is exposed to remote code execution, which may lead to system compromise and data leakage.
Recommendation
It is recommended to update to the latest version of PivotX and implement additional security measures to prevent the upload of dangerous files.
Other vulnerabilities in PivotX 2.3.11
See all- CVE-2017-8402High
PivotX version 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.
- CVE-2017-7570High
PivotX version 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by uploading a file with a safe extension (such as .jpg) and then invoking the duplicate function to change the extension to .php.
- CVE-2015-5457High
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, allowing remote attackers to execute arbitrary code by uploading a crafted file.
Original NVD description (English source)
lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.