vendor:
TestLink
by:
snovvcrash
8.8
CVSS
HIGH
Unrestricted File Upload
CWE
Product Name: TestLink
Affected Version From: 1.9.20
Affected Version To: 1.9.20
Patch Exists: YES
Related CWE: CVE-2020-8639
CPE:
Platforms Tested: Ubuntu 20.10
2021
TestLink 1.9.20 – Unrestricted File Upload (Authenticated)
This exploit allows an authenticated user to upload any file to the server, including malicious files that can be used for remote code execution.
Mitigation:
Update to a patched version of TestLink that fixes the file upload vulnerability.