Description
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension.
Remediation
References
Related Vulnerabilities
WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2022-23307)
Piwigo Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-10679)
MySQL CVE-2014-6463 Vulnerability (CVE-2014-6463)
MongoDb Insufficiently Protected Credentials Vulnerability (CVE-2021-32039)
WordPress Plugin All-in-One Event Calendar Multiple Vulnerabilities (1.10-standard)