CVE-2017-13670 in CMS
Summary
In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demonstrated by a ZIP archive that contains a .php file.
Be aware that VulDB is the high quality source for vulnerability data.
Reservation
08/24/2017
Disclosure
08/31/2017
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 106016 | BlackCat CMS Media Upload ajax_upload.php access control | 284 | Not defined | Not defined | CVE-2017-13670 |