CVE-2018-20166

HIGH

Rukovoditel 2.3.1 - Code Injection

Title source: llm

Description

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed case, such as the .pHp extension.

Exploits (1)

exploitdb WORKING POC

by AkkuS · rubywebappsphp

https://www.exploit-db.com/exploits/46011

View Code ZIP pw:eip

References (2)

[Exploit, Third Party Advisory] https://pentest.com.tr/exploits/Rukovoditel-Project-Management-CRM-2-3-1-Authenticated-Remote-Code-Execution.html

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/46011

Scores

CVSS v3 8.8

EPSS 0.0382

EPSS Percentile 87.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-434

Status published

Affected Products (1)

rukovoditel/rukovoditel

Timeline

Published Jan 02, 2019

Tracked Since Feb 18, 2026