fuzzlove/eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE

fuzzlove/eLabFTW-1.8.5-EntityController-Arbitrary-File-Upload-RCE

GitHubGitHub
GitHubgithub.com
incidentsecurity.comincidentsecurity.com
Releases0
Stars7
eLabFTW 1.8.5 'EntityController' Arbitrary File Upload / RCE (CVE-2019-12185)
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2019-12185↗
—9 HIGH

eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.