CVE-2017-14399

In BlackCat CMS 1.2.2, unrestricted file upload is possible in backend\media\ajax_rename.php via the extension parameter, as demonstrated by changing the extension from .jpg to .php.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2017-09-12

Last modified

2024-09-17

Weaknesses

CWE-434

Affected products

• Blackcat Cms (Blackcat-cms)

References

• https://github.com/SPuerBRead/blackcat-cms-file-upload/blob/master/README.md