CVE-2017-14958 lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.
HighCVSS 7.2
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib.php in PivotX 2.3.11 does not properly block uploads of dangerous file types by admin users, which allows remote PHP code execution via an upload of a .php file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pivotx | = 2.3.11 | No fix listed |
References
- sourceforge.net issue-tracking patch third-party-advisory