CVE-2014-9567: Code Injection
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9567?
CVE-2014-9567 has a high severity rating due to its potential for remote code execution.
What versions of ProjectSend are affected by CVE-2014-9567?
CVE-2014-9567 affects ProjectSend versions r100 through r561.
How do I fix CVE-2014-9567?
To fix CVE-2014-9567, upgrade to a version of ProjectSend that is patched beyond r561.
What is the impact of CVE-2014-9567 on security?
CVE-2014-9567 allows untrusted file uploads, enabling attackers to execute arbitrary PHP code.
How can I mitigate risks associated with CVE-2014-9567?
Mitigating risks associated with CVE-2014-9567 includes restricting file upload permissions and validating file types.