Description

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajax_upload.

Remediation

References

CVE-2016-10751

Related Vulnerabilities

WordPress Plugin Newsletter-Send awesome emails from WordPress Unspecified Vulnerability (4.1.1)

WordPress Other Vulnerability (CVE-2005-2110)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-41183)

Apache HTTP Server Improper Input Validation Vulnerability (CVE-2011-3639)

WordPress Plugin Plug your WooCommerce into the largest catalog of customized print products from Helloprint Cross-Site Scripting (1.4.6)

Severity

High

Classification

CVE-2016-10751 CWE-22 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities