Description
Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.
Remediation
References
Related Vulnerabilities
WordPress Plugin RBX Gallery 'uploader.php' Arbitrary File Upload (2.1)
MySQL Other Vulnerability (CVE-2006-1517)
WordPress Plugin Team Members Cross-Site Scripting (5.2.0)
WordPress Plugin Contact Form 7 Multi-Step Addon Malicious Code (1.0.5)
Contao Improper Input Validation Vulnerability (CVE-2020-25768)