CVE-2019-17575 File upload in n/a
Authenticated admins can bypass file rename filters to upload and execute arbitrary PHP code via crafted filenames.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-17575?
CVE-2019-17575 is a high-severity vulnerability in n/a, published on 14 Oct 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph and change the file's extension to p. Because of concatenation, the name is then treated as filename.php.) At the result, remote attackers can execute arbitrary PHP code.
Weakness: CWE-706
Which versions are affected by CVE-2019-17575?
It affects 1 product.
Products include Wbce Wbce Cms.
How do I fix CVE-2019-17575?
No fix has been published for CVE-2019-17575 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-17575 being exploited?
There is no known exploitation of CVE-2019-17575 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-39796 SQL injection in n/a
- CVE-2022-46020 File upload in n/a
- CVE-2021-3817 SQL Injection in wbce/wbce_cms
- CVE-2025-65950 WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups[] Parameter
- CVE-2025-67504 WBCE CMS has Weak Random Number Generator in Password Generation Function
Sources
Also known as GHSA-m48x-5wvq-wmqg.