cve/2015/CVE-2015-5457.md

CVE-2015-5457

Description

PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary code by uploading a crafted file, as demonstrated by a file named foo.php.php.

POC

Reference

• http://packetstormsecurity.com/files/132474/PivotX-2.3.10-Session-Fixation-XSS-Code-Execution.html

Github

No PoCs found on GitHub currently.