critical9.8Public exploit code
CVE-2017-7402
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Pixie 1.0.4 - Arbitrary File Upload2017-04-02 · webapps · php
Impact
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lucidcrew | Pixie | Version 1.04 |