CVE-2023-5966
Unrestricted Upload of File with Dangerous Type in EspoCRM
Résumé
Unrestricted Upload of File with Dangerous Type in EspoCRM
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.
Références
- advisory github.com
- advisory nvd.nist.gov
- web incibe.es