Arbitrary File Upload Vulnerability in OKLite by OKLite
CVE-2019-16131

8.8HIGH

Key Information:

Vendor

PHPok

Status
Oklite
Vendor
CVE Published:
9 September 2019

What is CVE-2019-16131?

OKLite v1.2.25 contains an arbitrary file upload vulnerability located in the framework/admin/modulec_control.php file. This vulnerability allows attackers to upload a .php file from a ZIP archive to the /data/cache/ directory, potentially compromising the application and associated server. Proper validation and sanitization of uploaded files are essential to mitigate the risks posed by this vulnerability.

References

http://www.iwantacve.cn/index.php/archives/289/
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.