Vulnerabilities > CVE-2018-18924 - Incomplete Cleanup vulnerability in Projeqtor

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

projeqtor

CWE-459

exploit available

NVD

Published: 2018-11-04

Updated: 2020-08-24

Summary

The image-upload feature in ProjeQtOr 7.2.5 allows remote attackers to execute arbitrary code by uploading a .shtml file with "#exec cmd" because rejected files remain on the server, with predictable filenames, after a "This file is not a valid image" error message.

Vulnerable Configurations

Part	Description	Count
Application	Projeqtor Projeqtor Projeqtor 0.1.0 Projeqtor Projeqtor 0.2.0 Projeqtor Projeqtor 0.3.0 Projeqtor Projeqtor 0.4.0 Projeqtor Projeqtor 0.5.0 Projeqtor Projeqtor 0.6.0 Projeqtor Projeqtor 0.6.1 Projeqtor Projeqtor 0.6.2 Projeqtor Projeqtor 0.7.0 Projeqtor Projeqtor 0.8.0 Projeqtor Projeqtor 0.8.1 Projeqtor Projeqtor 0.9.0 Projeqtor Projeqtor 1.0.0 Projeqtor Projeqtor 1.0.1 Projeqtor Projeqtor 1.1.0 Projeqtor Projeqtor 1.2.0 Projeqtor Projeqtor 1.2.1 Projeqtor Projeqtor 1.3.0 Projeqtor Projeqtor 1.3.1 Projeqtor Projeqtor 1.4.0 Projeqtor Projeqtor 1.4.1 Projeqtor Projeqtor 1.4.2 Projeqtor Projeqtor 1.5.0 Projeqtor Projeqtor 1.5.1 Projeqtor Projeqtor 1.5.2 Projeqtor Projeqtor 1.5.3 Projeqtor Projeqtor 1.5.4 Projeqtor Projeqtor 1.5.5 Projeqtor Projeqtor 1.6.0 Projeqtor Projeqtor 1.6.1 Projeqtor Projeqtor 1.6.2 Projeqtor Projeqtor 1.7.0 Projeqtor Projeqtor 1.7.1 Projeqtor Projeqtor 1.7.2 Projeqtor Projeqtor 1.8.0 Projeqtor Projeqtor 1.8.1 Projeqtor Projeqtor 1.8.2 Projeqtor Projeqtor 1.8.3 Projeqtor Projeqtor 1.9.0 Projeqtor Projeqtor 1.9.1 Projeqtor Projeqtor 2.0.0 Projeqtor Projeqtor 2.0.1 Projeqtor Projeqtor 2.1.0 Projeqtor Projeqtor 2.1.1 Projeqtor Projeqtor 2.2.0 Projeqtor Projeqtor 2.2.1 Projeqtor Projeqtor 2.2.2 Projeqtor Projeqtor 2.2.3 Projeqtor Projeqtor 2.3.0 Projeqtor Projeqtor 2.4.0 Projeqtor Projeqtor 2.4.1 Projeqtor Projeqtor 2.4.2 Projeqtor Projeqtor 2.4.3 Projeqtor Projeqtor 2.5.0 Projeqtor Projeqtor 2.5.1 Projeqtor Projeqtor 2.5.2 Projeqtor Projeqtor 2.5.3 Projeqtor Projeqtor 2.6.0 Projeqtor Projeqtor 2.6.1 Projeqtor Projeqtor 2.6.2 Projeqtor Projeqtor 2.6.3 Projeqtor Projeqtor 3.0.0 Projeqtor Projeqtor 3.0.1 Projeqtor Projeqtor 3.0.2 Projeqtor Projeqtor 3.1.0 Projeqtor Projeqtor 3.1.1 Projeqtor Projeqtor 3.1.2 Projeqtor Projeqtor 3.1.3 Projeqtor Projeqtor 3.1.4 Projeqtor Projeqtor 3.2.0 Projeqtor Projeqtor 3.2.1 Projeqtor Projeqtor 3.2.2 Projeqtor Projeqtor 3.3.0 Projeqtor Projeqtor 3.3.1 Projeqtor Projeqtor 3.3.2 Projeqtor Projeqtor 3.4.0 Projeqtor Projeqtor 3.4.1 Projeqtor Projeqtor 3.4.2 Projeqtor Projeqtor 3.4.3 Projeqtor Projeqtor 3.4.4 Projeqtor Projeqtor 4.0.0 Projeqtor Projeqtor 4.0.1 Projeqtor Projeqtor 4.0.2 Projeqtor Projeqtor 4.0.3 Projeqtor Projeqtor 4.0.4 Projeqtor Projeqtor 4.0.5 Projeqtor Projeqtor 4.0.6 Projeqtor Projeqtor 4.1.0 Projeqtor Projeqtor 4.1.1 Projeqtor Projeqtor 4.1.2 Projeqtor Projeqtor 4.2.0 Projeqtor Projeqtor 4.2.1 Projeqtor Projeqtor 4.2.2 Projeqtor Projeqtor 4.2.3 Projeqtor Projeqtor 4.3.0 Projeqtor Projeqtor 4.3.1 Projeqtor Projeqtor 4.3.2 Projeqtor Projeqtor 4.3.3 Projeqtor Projeqtor 4.4.0 Projeqtor Projeqtor 4.4.1 Projeqtor Projeqtor 4.4.2 Projeqtor Projeqtor 4.5.0 Projeqtor Projeqtor 4.5.1 Projeqtor Projeqtor 4.5.2 Projeqtor Projeqtor 4.5.3 Projeqtor Projeqtor 4.5.4 Projeqtor Projeqtor 4.5.5 Projeqtor Projeqtor 4.5.6 Projeqtor Projeqtor 4.5.7 Projeqtor Projeqtor 5.0.0 Projeqtor Projeqtor 5.0.1 Projeqtor Projeqtor 5.0.2 Projeqtor Projeqtor 5.0.3 Projeqtor Projeqtor 5.0.4 Projeqtor Projeqtor 5.0.5 Projeqtor Projeqtor 5.0.6 Projeqtor Projeqtor 5.1.0 Projeqtor Projeqtor 5.1.1 Projeqtor Projeqtor 5.1.2 Projeqtor Projeqtor 5.1.3 Projeqtor Projeqtor 5.1.4 Projeqtor Projeqtor 5.1.5 Projeqtor Projeqtor 5.2.0 Projeqtor Projeqtor 5.2.1 Projeqtor Projeqtor 5.2.2 Projeqtor Projeqtor 5.2.3 Projeqtor Projeqtor 5.2.4 Projeqtor Projeqtor 5.2.5 Projeqtor Projeqtor 5.3.0 Projeqtor Projeqtor 5.3.1 Projeqtor Projeqtor 5.3.2 Projeqtor Projeqtor 5.3.3 Projeqtor Projeqtor 5.3.4 Projeqtor Projeqtor 5.3.5 Projeqtor Projeqtor 5.4.0 Projeqtor Projeqtor 5.4.1 Projeqtor Projeqtor 5.4.2 Projeqtor Projeqtor 5.4.3 Projeqtor Projeqtor 5.4.4 Projeqtor Projeqtor 5.4.5 Projeqtor Projeqtor 5.5.0 Projeqtor Projeqtor 5.5.1 Projeqtor Projeqtor 5.5.2 Projeqtor Projeqtor 5.5.3 Projeqtor Projeqtor 5.5.4 Projeqtor Projeqtor 6.0.0 Projeqtor Projeqtor 6.0.1 Projeqtor Projeqtor 6.0.2 Projeqtor Projeqtor 6.0.3 Projeqtor Projeqtor 6.0.4 Projeqtor Projeqtor 6.0.5 Projeqtor Projeqtor 6.0.6 Projeqtor Projeqtor 6.0.7 Projeqtor Projeqtor 6.0.8 Projeqtor Projeqtor 6.1.0 Projeqtor Projeqtor 6.1.1 Projeqtor Projeqtor 6.1.2 Projeqtor Projeqtor 6.1.3 Projeqtor Projeqtor 6.2.0 Projeqtor Projeqtor 6.2.1 Projeqtor Projeqtor 6.2.2 Projeqtor Projeqtor 6.2.3 Projeqtor Projeqtor 6.2.4 Projeqtor Projeqtor 6.2.5 Projeqtor Projeqtor 6.3.0 Projeqtor Projeqtor 6.3.1 Projeqtor Projeqtor 6.3.2 Projeqtor Projeqtor 6.3.3 Projeqtor Projeqtor 6.3.4 Projeqtor Projeqtor 6.3.5 Projeqtor Projeqtor 6.3.6 Projeqtor Projeqtor 6.3.7 Projeqtor Projeqtor 6.4.0 Projeqtor Projeqtor 6.4.1 Projeqtor Projeqtor 6.4.2 Projeqtor Projeqtor 6.4.3 Projeqtor Projeqtor 6.4.4 Projeqtor Projeqtor 6.5.0 Projeqtor Projeqtor 6.5.1 Projeqtor Projeqtor 6.5.2 Projeqtor Projeqtor 6.5.3 Projeqtor Projeqtor 6.5.4 Projeqtor Projeqtor 6.5.5 Projeqtor Projeqtor 6.5.6 Projeqtor Projeqtor 6.5.7 Projeqtor Projeqtor 7.0.0 Projeqtor Projeqtor 7.0.1 Projeqtor Projeqtor 7.0.2 Projeqtor Projeqtor 7.0.3 Projeqtor Projeqtor 7.0.4 Projeqtor Projeqtor 7.0.5 Projeqtor Projeqtor 7.0.6 Projeqtor Projeqtor 7.0.7 Projeqtor Projeqtor 7.0.8 Projeqtor Projeqtor 7.0.9 Projeqtor Projeqtor 7.1.0 Projeqtor Projeqtor 7.1.1 Projeqtor Projeqtor 7.1.2 Projeqtor Projeqtor 7.1.3 Projeqtor Projeqtor 7.1.4 Projeqtor Projeqtor 7.1.5 Projeqtor Projeqtor 7.2.0 Projeqtor Projeqtor 7.2.1 Projeqtor Projeqtor 7.2.2 Projeqtor Projeqtor 7.2.3 Projeqtor Projeqtor 7.2.4 Projeqtor Projeqtor 7.2.5	207

Common Weakness Enumeration (CWE)

CWE-459 - Incomplete Cleanup

Exploit-Db

file	exploits/php/webapps/45680.txt
id	EDB-ID:45680
last seen	2018-11-30
modified	2018-10-25
platform	php
port
published	2018-10-25
reporter	Exploit-DB
source	https://www.exploit-db.com/download/45680
title	ProjeQtOr Project Management Tool 7.2.5 - Remote Code Execution
type	webapps

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Exploit-Db

References