CVE-2017-11756 - CVE House
Back to Database
Status published High CVE-2017-11756

In Earcms Ear Music through 4.1 build 20170710, remote authenticated...

Vulnerability Description

In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and then using user.php/music/add/ to upload the code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-11756

Credits & Attribution

No credits recorded in the NVD database.

References

More from earcms

View All →
CVE-2020-18912
An issue found in Earcms Ear App v.20181124 allows a...
Critical 9.8

Affected Vendor

Affected Software

ear music
Vulnerable Versions:
0

Timeline

Official Publish: July 30th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.