CVE-2018-18874

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=file_manager_upload URI.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-10-31

Last modified

2024-09-16

Weaknesses

CWE-434

Affected products

• Nc-cms (Nconsulting)

References

• https://github.com/gnat/nc-cms/issues/11