Craft CMS 2.6.3000 allows remote malicious users to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
craftcms craft cms 2.6.3000 |