Description
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
phpCollab 2.5.1 Unauthenticated File Upload
exploit/unix/webapp/phpcollab_upload_exec
Exploit-DB 2
- phpCollab 2.5.1 - File Upload (Metasploit) EDB-43519 · remote · Jan 11, 2018 · verified
- phpCollab 2.5.1 - Arbitrary File Upload EDB-42934 · webapps · Oct 2, 2017 · verified
GitHub 1 repository
-
jlk/exploit-CVE-2017-6090 ★ 1 · Feb 17, 2018
Containerized exploitable PhpCollab
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- PhpColl 2.5.1 Arbitrary File Upload http/cves/2017/CVE-2017-6090.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.