CVE-2016-10759 The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to...
CriticalCVSS 9.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| precurio | = 2.1 | No fix listed |
References
- blog.ripstech.com exploit third-party-advisory
- demo.ripstech.com third-party-advisory