Description
Victor CMS 1.0 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the profile image upload feature. Attackers can upload a PHP shell to the /img directory and execute system commands by accessing the uploaded file via web browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VictorAlagwu | CMSsite | 1.0 | — |
References
- ExploitDB-49310 exploit
- Victor CMS Project Repository product
- VulnCheck Advisory: Victor CMS 1.0 - File Upload To RCE third-party-advisory