CVE-2017-8402
HighSummary
PivotX version 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.
Risk Assessment
Exploitation of this vulnerability could lead to server takeover and execution of malicious code, posing a serious security threat to the organization.
Recommendation
It is recommended to update to the latest version of PivotX and restrict file upload capabilities for users.
Other vulnerabilities in PivotX 2.3.11
See all- CVE-2017-14958High
lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.
- CVE-2017-7570High
PivotX version 2.3.11 allows remote authenticated Advanced users to execute arbitrary PHP code by uploading a file with a safe extension (such as .jpg) and then invoking the duplicate function to change the extension to .php.
- CVE-2015-5457High
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, allowing remote attackers to execute arbitrary code by uploading a crafted file.
Original NVD description (English source)
PivotX 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.