Description
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2013-1563 Vulnerability (CVE-2013-1563)
SharePoint Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-1261)
WordPress Plugin ApplyOnline-Application Form Builder and Manager Arbitrary File Disclosure (1.9.92)
Oracle JRE CVE-2013-2439 Vulnerability (CVE-2013-2439)
WordPress Plugin Nelio AB Testing Server-Side Request Forgery (4.5.10)