Description

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.

Remediation

References

CVE-2016-10751

Related Vulnerabilities

Piwigo Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-26266)

WordPress Plugin Age Gate Cross-Site Scripting (2.16.3)

Drupal Core 4.6.x Security Bypass (4.6.0 - 4.6.5)

Internet Information Services CVE-2006-6578 Vulnerability (CVE-2006-6578)

MediaWiki CVE-2023-29139 Vulnerability (CVE-2023-29139)

Severity

High

Classification

CVE-2016-10751 CWE-22 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities