Exploitation Summary
EIP tracks 2 public exploits for CVE-2019-19576. PoCs published by Jinny Ramsmark, jra89.
AI-analyzed exploit summary This exploit generates a malicious JPEG file with embedded PHP code to achieve Remote Code Execution (RCE) in Verot class.upload.php versions <=2.0.3. It injects a PHP payload into the JPEG file's end-of-file marker, bypassing image validation checks.
Description
class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
Exploits (2)
This exploit generates a malicious JPEG file with embedded PHP code to achieve Remote Code Execution (RCE) in Verot class.upload.php versions <=2.0.3. It injects a PHP payload into the JPEG file's end-of-file marker, bypassing image validation checks.
This repository contains a functional exploit for CVE-2019-19576, demonstrating arbitrary file upload and remote code execution in class.upload.php <= 2.0.3 via a phar extension bypass and image payload injection.
References (10)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H