Description
WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file path.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| luiswang | WebTareas | 2.4 | — |
References
- ExploitDB-51089 exploit
- WebTareas Project Homepage product
- VulnCheck Advisory: WebTareas 2.4 Authenticated Remote Code Execution via File Upload third-party-advisory