medium6.5Public exploit code
CVE-2019-8404
An issue was discovered in Webiness Inventory 2.3.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload2019-02-18 · webapps · php
Impact
An issue was discovered in Webiness Inventory 2.3. The ProductModel component allows Arbitrary File Upload via a crafted product image during the creation of a new product. Consequently, an attacker can steal information from the site with the help of an installed executable file, or change the contents of pages.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webiness Inventory Project | Webiness Inventory | Version 2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html
- https://sourceforge.net/projects/webinessinventory/files/
- https://www.exploit-db.com/exploits/46405/
- http://packetstormsecurity.com/files/151763/Webiness-Inventory-2.3-Arbitrary-File-Upload.html
- https://sourceforge.net/projects/webinessinventory/files/
- https://www.exploit-db.com/exploits/46405/