CVE-2017-11760

uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-07-31

Last modified

2024-09-16

Weaknesses

CWE-94

Affected products

• Projeqtor (Projeqtor)

References

• https://track.projeqtor.org/view/main.php?directAccess=true&objectClass=Ticket&objectId=2884