Published: 04/12/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

class.upload.php in verot.net class.upload prior to 1.0.3 and 2.x prior to 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
verot project verot
getk2 k2

# Exploit Title: Verot 203 - Remote Code Execution # Date: 2019-12-05 # Exploit Author: Jinny Ramsmark # Vendor Homepage: wwwverotnet/php_class_uploadhtm # Software Link: githubcom/verot/classuploadphp # Version: <=203 # Tested on: Ubuntu 1910, PHP 73, Apache/2441 # CVE : CVE-2019-19576 <?php #Title: jpeg payloa ...

Verot version 203 suffers from a remote code execution vulnerability ...

This is a filter bypass exploit that results in arbitrary file upload and remote code execution in class.upload.php <= 2.0.4

CVE-2019-19634 - classuploadphp <= 204 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verotnet Affected product - classuploadphp <= 204 Tested on newly installed Ubuntu 1404 with PHP5 and Apache Specifically Debian/Ubuntu has been found to be vulnerable since they add the pht extension among others to available PHP handlers In this cas

CWE-434 https://github.com/verot/class.upload.php/compare/1.0.2...1.0.3 https://github.com/getk2/k2/commit/d1344706c4b74c2ae7659b286b5a066117155124 https://www.verot.net/php_class_upload.htm https://github.com/verot/class.upload.php/commit/db1b4fe50c1754696970d8b437f07e7b94a7ebf2 https://github.com/verot/class.upload.php/compare/2.0.3...2.0.4 https://github.com/verot/class.upload.php/commit/5a7505ddec956fdc9e9c071ae5089865559174f1 https://www.verot.net https://github.com/jra89/CVE-2019-19576 http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html https://medium.com/%40jra8908/cve-2019-19576-e9da712b779 https://nvd.nist.gov https://github.com/jra89/CVE-2019-19634 https://www.exploit-db.com/exploits/47749

CVE-2019-19576

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect