CVE-2020-10557: Malicious File Upload
An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload section in the file manager page contains an arbitrary file upload vulnerability via upload.php. The extension .php7 bypasses file upload restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-10557?
CVE-2020-10557 is considered a medium severity vulnerability due to its potential for remote code execution via arbitrary file uploads.
How do I fix CVE-2020-10557?
To fix CVE-2020-10557, update AContent to the latest version or implement strict validation for file uploads to restrict the upload of executable files.
What are the potential impacts of CVE-2020-10557?
The impacts of CVE-2020-10557 can include unauthorized access to the server and the ability to execute commands with the privileges of a low-privileged account.
Who is affected by CVE-2020-10557?
CVE-2020-10557 affects all versions of AContent up to and including 1.4.
Is CVE-2020-10557 exploitable remotely?
Yes, CVE-2020-10557 is exploitable remotely through the vulnerable file upload functionality.