CVE-2020-16629

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2021-02-08

Last modified

2024-08-04

Weaknesses

CWE-89

Affected products

• Phpok (Phpok)

References

• https://github.com/Gh0stF/phpok_cve/issues/1