CVE-2019-17575 - CVE House
Back to Database
Status published High CVE-2019-17575

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS...

Vulnerability Description

A file-rename filter bypass exists in admin/media/rename.php in WBCE CMS 1.4.0 and earlier. This can be exploited by an authenticated user with admin privileges to rename a media filename and extension. (For example: place PHP code in a .jpg file, and then change the file's base name to filename.ph and change the file's extension to p. Because of concatenation, the name is then treated as filename.php.) At the result, remote attackers can execute arbitrary PHP code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17575

Credits & Attribution

No credits recorded in the NVD database.

References

More from wbce

View All →
CVE-2024-58283
WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload
High 8.7
CVE-2022-46020
WBCE CMS v1.5.4 can implement getshell by modifying the upload...
Unknown 0
CVE-2022-45040
A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS...
Unknown 0
CVE-2022-45039
An arbitrary file upload vulnerability in the Server Settings module...
Unknown 0
CVE-2022-45038
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS...
Unknown 0

Affected Vendor

Affected Software

wbce cms
Vulnerable Versions:
0

Timeline

Official Publish: October 14th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.