CVE-2017-11760
HIGHProjeQtOr < 6.3.1 - Authenticated PHP Code Execution via Image Upload
Title source: llmDescription
uploadImage.php in ProjeQtOr before 6.3.2 allows remote authenticated users to execute arbitrary PHP code by uploading a .php file composed of concatenated image data and script data, as demonstrated by uploading as an image within the description text area.
References (1)
Core 1
Core References
Permissions Required x_refsource_confirm
https://track.projeqtor.org/view/main.php?directAccess=true&objectClass=Ticket&objectId=2884
Scores
CVSS v3
8.8
EPSS
0.0128
EPSS Percentile
66.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-94
Status
published
Products (1)
projeqtor/projeqtor
< 6.3.1
Published
Jul 31, 2017
Tracked Since
Feb 18, 2026