CVE-2018-19463: Code Injection
DISPUTED zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP by uploading an image in current version." It also requires authentication.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2018-19463.
What is the title of this vulnerability?
The title of this vulnerability is ** DISPUTED ** zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers …
What is the severity of CVE-2018-19463?
The severity of CVE-2018-19463 is high with a CVSS score of 8.8.
What does CVE-2018-19463 allow remote attackers to do?
CVE-2018-19463 allows remote attackers to execute arbitrary PHP code.
How can I fix CVE-2018-19463?
To fix CVE-2018-19463, apply the necessary patches or updates provided by the vendor Z-BlogPHP.