Description
An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of a file can be changed and the control can be bypassed for code execution. (An attacker can use the GIF header for this.)
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 2
- CuteNews 2.1.2 - Remote Code Execution EDB-48800 · webapps · Sep 10, 2020 · verified
- CuteNews 2.1.2 - 'avatar' Remote Code Execution (Metasploit) EDB-46698 · remote · Apr 15, 2019 · verified
GitHub 6 repositories
-
thewhiteh4t/cve-2019-11447 ★ 9 · Mar 18, 2021
CutePHP Cute News 2.1.2 RCE PoC
-
CRFSlick/CVE-2019-11447-POC ★ 1 · Feb 11, 2024
CuteNews 2.1.2 - CVE-2019-11447 Proof-Of-Concept
-
khuntor/CVE-2019-11447-EXP ★ 1 · Oct 30, 2020
CuteNews Avatar 2.1.2 Remote Code Execution Vulnerability
-
capivara-research/WordPress-Path-Traversal-CVE-2019-11447 ★ 0 · Aug 22, 2026
CPTS HackTheBox - Penetration Test Report: WordPress Path Traversal CVE-2019-11447
-
substing/CVE-2019-11447_reverse_shell_upload ★ 0 · Dec 28, 2023
-
ColdFusionX/CVE-2019-11447_CuteNews-AvatarUploadRCE ★ 0 · Mar 17, 2021
Exploit Code for CVE-2019-11447 aka CuteNews 2.1.2 Avatar upload RCE (Authenticated)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.