Download Manager, 4ca9f811-3461-4dea-938f-1528440e2708
- CVE, Research URL
- Home page URL
- Application
- Published on
- -
- Research Description
- Download Manager [download-manager] < 3.1.19 Download Manager < 3.1.19 - Authenticated (author+) PHP4 File Upload to RCE The wpdm_admin_upload_file AJAX action used a blacklist approach to forbid potential dangerous files, such as PHP, from being uploaded. However, other dangerous extensions, like .php4 were not forbidden.
- Affected versions
-
max 3.1.19.
- Status
-
vulnerable