high7.2
CVE-2020-24986
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager.
Impact
Concrete5 up to and including 8.5.2 allows Unrestricted Upload of File with Dangerous Type such as a .php file via File Manager. It is possible to modify site configuration to upload the PHP file and execute arbitrary commands.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Concretecms | Concrete Cms | through 8.5.2 |