Unrestricted File Upload in ProjectSend by the ProjectSend Vendor

CVE-2014-9567

What is CVE-2014-9567?

An unrestricted file upload vulnerability in the 'process-upload.php' script of ProjectSend enables remote attackers to upload files with executable PHP extensions. By exploiting this flaw, an attacker can execute arbitrary PHP code on the server. This vulnerability arises from inadequate validation of uploaded files, allowing malicious files to be stored in directories such as 'upload/files/' or 'upload/temp/', which can then be accessed directly to compromise the integrity and security of the affected system.

References