LUCY Security Awareness Software up to and including 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
lucysecurity security awareness |