high7.5Public exploit code
CVE-2018-9205
Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Drupal avatar_uploader v7.x-1.0-beta8 - Arbitrary File Disclosure2018-04-23 · webapps · php
Impact
Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Avatar Uploader | Version 7.x-1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.vapidlabs.com/advisory.php?v=202
- https://www.drupal.org/project/avatar_uploader
- https://www.drupal.org/project/avatar_uploader/issues/2957966
- https://www.exploit-db.com/exploits/44501/
- http://www.vapidlabs.com/advisory.php?v=202
- https://www.drupal.org/project/avatar_uploader
- https://www.drupal.org/project/avatar_uploader/issues/2957966
- https://www.exploit-db.com/exploits/44501/