Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-19634. PoCs published by jra89.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2019-19634, demonstrating arbitrary file upload and remote code execution in class.upload.php <= 2.0.4 by bypassing the file extension blacklist and injecting PHP code into a valid image file.
Description
class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.
Exploits (1)
This repository contains a functional exploit for CVE-2019-19634, demonstrating arbitrary file upload and remote code execution in class.upload.php <= 2.0.4 by bypassing the file extension blacklist and injecting PHP code into a valid image file.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H