GHSA-9r2j-rg24-fvpj
FrozenNode Laravel-Administrator unrestricted file upload
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | frozennode/administrator | <= 5.0.12 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via `admin/tips_image/image/file_upload` image upload with PHP content within a GIF image that has the `.php` extension. NOTE: this product is discontinued.
References
External links from the advisory. They lead to third-party sites.