Published: 17/12/2019 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

class.upload.php in verot.net class.upload up to and including 1.0.3 and 2.x up to and including 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Vulnerable Product	Search on Vulmon	Subscribe to Product
verot project verot
getk2 k2

This is a filter bypass exploit that results in arbitrary file upload and remote code execution in class.upload.php <= 2.0.4

CVE-2019-19634 - classuploadphp <= 204 Arbitrary file upload Author - Jinny Ramsmark Affected vendor - Verotnet Affected product - classuploadphp <= 204 Tested on newly installed Ubuntu 1404 with PHP5 and Apache Specifically Debian/Ubuntu has been found to be vulnerable since they add the pht extension among others to available PHP handlers In this cas

CWE-434 https://github.com/jra89/CVE-2019-19634 https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php#L3068 https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e https://nvd.nist.gov https://github.com/jra89/CVE-2019-19634

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-19634

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect