job/uploadfile_save.php in MetInfo up to and including 5.3.17 blocks the .php extension but not related extensions, which might allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions involving admin/system/safe.php and job/cv.php.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
metinfo project metinfo |