Description
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.
Remediation
References
Related Vulnerabilities
Python CVE-2019-17514 Vulnerability (CVE-2019-17514)
WordPress Plugin EWWW Image Optimizer Remote Code Execution (2.8.3)
WordPress Plugin Accept Signups 'email' Parameter Cross-Site Scripting (0.1)
Drupal Other Vulnerability (CVE-2005-3973)
Oracle Database Server CVE-2023-22075 Vulnerability (CVE-2023-22075)