CVE-2016-10752: Malicious File Upload
Published May 24, 2019
·Updated
serendipitymoveMediaDirectory in Serendipity 2.0.3 allows remote attackers to upload and execute arbitrary PHP code because it mishandles an extensionless filename during a rename, as demonstrated by "php" as a filename.
Affected Software
1 affected component
S9Y serendipity=2.0.3
Event History
May 24, 2019
CVE Published
via MITRE·05:40 PM
Data Sourced
via MITRE·05:40 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-10752?
CVE-2016-10752 is considered critical as it allows remote code execution via arbitrary PHP uploads.
2
How do I fix CVE-2016-10752?
Updating Serendipity to a version above 2.0.3, which addresses this vulnerability, is necessary to mitigate the risk.
3
Which versions of Serendipity are affected by CVE-2016-10752?
CVE-2016-10752 specifically affects Serendipity version 2.0.3.
4
What type of attack does CVE-2016-10752 enable?
CVE-2016-10752 enables remote attackers to upload and execute arbitrary PHP code on the server.
5
What is the root cause of CVE-2016-10752?
The vulnerability arises from mishandling extensionless filenames during file renaming in the serendipity_moveMediaDirectory function.