high8.8
CVE-2019-20385
The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/* content type.
Impact
The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo Aware CallManager 2012 devices allows upload of .php files with a text/* content type. The PHP code can then be executed by visiting a /supervisor/csv/ URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Logaritmo | Aware Callmanager | Version 2012 |