CVE-2023-5965
Unrestricted Upload of File with Dangerous Type in EspoCRM
Summary
Unrestricted Upload of File with Dangerous Type in EspoCRM
Original description
The description as published by the source.
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.
References
- advisory github.com
- advisory nvd.nist.gov
- web incibe.es