CVE-2020-10682 File upload in n/a
Remote attackers can execute arbitrary code by uploading a malicious file disguised as a JPEG image to the Filemanager module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-10682?
CVE-2020-10682 is a high-severity vulnerability in Cmsmadesimple Cms Made Simple, published on 20 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1_files[] to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).
Weakness: CWE-434
Which versions are affected by CVE-2020-10682?
It affects 1 product.
Products include Cmsmadesimple Cms Made Simple.
How do I fix CVE-2020-10682?
No fix has been published for CVE-2020-10682 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10682 being exploited?
There is no known exploitation of CVE-2020-10682 in the wild and no public exploit code.
Other vulnerabilities in Cmsmadesimple Cms Made Simple
Sources
Also known as GHSA-gf48-xrvx-46x9.