Description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in Croogo up to 4.0.7. This affects an unknown part of the file admin/settings/settings/prefix/Theme of the component Setting Handler. The manipulation of the argument Content-Type leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-271053 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Croogo | 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 | — |
References
- VDB-271053 | Croogo Setting Theme unrestricted upload vdb-entry technical-description
- VDB-271053 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #372009 | croogo.org croogo v4.0.7 Upload third-party-advisory
- https://github.com/DeepMountains/Mirage/blob/main/CVE-1.md exploit