vendor:
Church Management System
by:
Abdullah Khawaja
9,8
CVSS
HIGH
Unauthenticated File Upload Vulnerability
264
CWE
Product Name: Church Management System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:sourcecodester:church_management_system:1.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Kali Linux, Windows 10 + XAMPP 7.4.4
2021
Church Management System 1.0 – Remote Code Execution (RCE) (Unauthenticated)
Church Management System (CMS-Website) 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters.
Mitigation:
Ensure that all user input is validated and sanitized before being used in any application logic.
