CVE-2018-19562

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background > Program Upgrade > Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive.

Score

CVSS 3.0 8.8 High

Status

Modified - cve@mitre.org

Published

2018-11-26

Last modified

2024-09-16

Weaknesses

CWE-434

Affected products

• Phpok (Phpok)

References

• http://www.iwantacve.cn/index.php/archives/87/