CVE-2019-9181

SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the…

published February 26, 2019

CVSS
—
EPSS
2%
Percentile
80.4
In the wild
Unconfirmed
What it is

SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01989 · 80.4th percentile
Published
2019-02-26T07:00Z
EPSS history
Timeline
  • 26 FEB 07:00Z
    SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the…
    cvelistv5