Description
Navigate CMS 2.8.7 contains a cross-site request forgery vulnerability that allows attackers to upload malicious extensions through a crafted HTML page. Attackers can trick authenticated administrators into executing arbitrary file uploads by leveraging the extension upload functionality without additional validation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Naviwebs S.C. | Navigate CMS | 2.8.7 | — |
References
- ExploitDB-48548 exploit
- Navigate CMS Official Homepage product
- Navigate CMS SourceForge Page product
- VulnCheck Advisory: Navigate CMS 2.8.7 - Cross-Site Request Forgery third-party-advisory