Arbitrary File Upload Vulnerability in AContent by Cinzinga
CVE-2020-10557

8.8HIGH

Key Information:

Vendor

Atutor

Status
Acontent
Vendor
CVE Published:
16 March 2020

What is CVE-2020-10557?

A vulnerability exists in AContent up to version 1.4, enabling low-privileged users to execute arbitrary commands on the server. This can be exploited through an insecure upload process in the file manager, specifically via upload.php where the extension .php7 allows for the circumvention of file upload restrictions, leading to potential unauthorized access or actions on the server.

References

https://sourceforge.net/projects/acontent/
x_refsource_MISC
https://github.com/cinzinga/CVEs/tree/master/CVE-2020-10557
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.