CVE-2023-53980
CriticalSummary
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.
Risk Assessment
The risk includes full server compromise, data theft, and use of the server for further attacks.
Recommendation
Update ProjectSend to the latest version and implement file type validation on the server.
Original NVD description (English source)
ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.