CVE-2017-15876
HighSummary
Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to restrict file upload capabilities to trusted types and implement additional validation mechanisms for uploaded files.
Other vulnerabilities in GPWeb 8.4.61
See all- CVE-2017-15877Critical
The CVE-2017-15877 vulnerability in the db.php file in GPWeb 8.4.61 has insecure permissions that allow remote attackers to view the password and user database.
- CVE-2017-15875Critical
CVE-2017-15875 is a SQL injection vulnerability in the Password Recovery feature in GPWeb 8.4.61. It allows remote attackers to execute arbitrary SQL commands via the 'checkemail' parameter.
Original NVD description (English source)
Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file, including a PHP shell.