CVE-2017-7402
CriticalSummary
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
Risk Assessment
This vulnerability allows attackers to execute code remotely, potentially leading to system takeover and data leakage.
Recommendation
It is recommended to upgrade to a newer version of Pixie and implement restrictions on allowed file types and extensions during file uploads.
Original NVD description (English source)
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.