Description (CNA)
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| s9y / Serendipity | affected 2.4.0 |
CWE
CWE-434
References
- https://www.exploit-db.com/exploits/51372
- https://docs.s9y.org/
- https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload
ADP enrichment
No English description supplied.