Remote Code Execution Vulnerability in Bludit by Bludit
CVE-2019-16113

8.8HIGH

Key Information:

Vendor

Bludit

Status
Bludit
Vendor
CVE Published:
8 September 2019

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 89%

What is CVE-2019-16113?

A vulnerability in Bludit 3.9.2 allows attackers to execute arbitrary PHP code by leveraging the image upload functionality. By renaming a PHP script with a .jpg file extension, an attacker can manipulate the upload process via the bl-kernel/ajax/upload-images.php endpoint. Furthermore, this potentially leads to writing additional PHP scripts at unauthorized paths, enabling extensive exploits within the affected environment.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2019-16113
Created by Rapid7

CVE-2019-16113
Created by cybervaca

CVE-2019-16113
Created by ynots0ups

References

https://github.com/bludit/bludit/issues/1081
x_refsource_MISC
http://packetstormsecurity.com/files/155295/Bludit-Direct...
x_refsource_MISC
http://packetstormsecurity.com/files/157988/Bludit-3.9.12...
x_refsource_MISC

EPSS Score

89% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

JSON
.