File Upload Vulnerability in Rukovoditel Product
CVE-2018-20166

8.8HIGH

Key Information:

Vendor: Rukovoditel
Status: Rukovoditel
Vendor: CVE Published:; 2 January 2019

🔔 Create Rukovoditel Vulnerability Alert

What is CVE-2018-20166?

A file-upload vulnerability exists in Rukovoditel 2.3.1, specifically in the configuration module. This flaw allows users to upload background images but fails to properly validate file extensions. It permits PHP file uploads disguised as GIF files, as long as they start with the correct header but possess a mixed case extension such as '.pHp'. This misconfiguration can lead to unauthorized code execution on the server, thereby compromising the integrity of the application.