vendor:
AuraCMS
by:
k1tk4t
8.1
CVSS
HIGH
Remote File Attachment
CWE
Product Name: AuraCMS
Affected Version From: AuraCMS 2.1
Affected Version To: AuraCMS 2.1
Patch Exists: NO
Related CWE:
CPE:
Platforms Tested:
AuraCMS 2.1 – Remote File Attachment – Local File Inclusion
The vulnerability exists in the '/mod/contak.php' file. It allows an attacker to include local files by manipulating the 'image' parameter in a POST request. This can lead to remote code execution or disclosure of sensitive information.
Mitigation:
The vendor has not released a patch for this vulnerability. To mitigate the risk, it is recommended to restrict access to the affected file or update to a newer version of the software when available.