CVE-2016-10759

The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resultant arbitrary code execution, via ExtendedFileManager/Classes/ExtendedFileManager.php because ExtendedFileManager can be used to rename the .htaccess file that blocks .php uploads.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2019-05-24

Last modified

2024-08-06

Weaknesses

CWE-22

Affected products

• Precurio (Precurio)

References

• https://blog.ripstech.com/2016/precurio-remote-command-execution-via-xinha-plugin/
• https://demo.ripstech.com/projects/precurio_2.1