CVE-2019-15751 File upload in n/a
Unauthenticated attackers can upload malicious SCORM files with executable extensions to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15751?
CVE-2019-15751 is a critical vulnerability in n/a, published on 7 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to the web root of the application.
Weakness: CWE-434
Which versions are affected by CVE-2019-15751?
It affects 1 product.
Products include Sitos Sitos Six.
How do I fix CVE-2019-15751?
No fix has been published for CVE-2019-15751 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15751 being exploited?
There is no known exploitation of CVE-2019-15751 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7ffh-mq47-jr43.