CVE-2020-10567
This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.6%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 19.64% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- tecrail/responsive filemanager
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html
- https://github.com/trippo/ResponsiveFilemanager/issues/600Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/171280/ZwiiCMS-12.2.04-Remote-Code-Execution.html
- https://github.com/trippo/ResponsiveFilemanager/issues/600Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.