Vulnerability CVE-2019-19576
Published: 2019-12-04

Description:
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Type:

CWE-434

 (Unrestricted Upload of File with Dangerous Type)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Verot project -> Verot 
Getk2 -> K2 

 References:
http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124
https://github.com/jra89/CVE-2019-19576
https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1
https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2
https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3
https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4
https://medium.com/@jra8908/cve-2019-19576-e9da712b779
https://www.verot.net
https://www.verot.net/php_class_upload.htm
Copyright 2024, cxsecurity.com

 

Back to Top