Description
Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Zenario CMS | 9.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | tribalsystems/zenario | < 9.2.55826 | 9.2.55826 | GHSA-6r86-2jm9-9mh4 |