CVE-2019-17188

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An unrestricted file upload vulnerability was discovered in catalog/productinfo/imageupload in Fecshop FecMall 2.3.4. An attacker can bypass a front-end restriction and upload PHP code to the webserver, by providing image data and the image/jpeg content type, with a .php extension. This occurs because the code relies on the getimagesize function.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Oct 4, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-171895.4totemodata 3.0.0_b936 has XSS via a folder name.CVE-2019-17195.4A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduCVE-2019-171907.8A Local Privilege Escalation issue was discovered in Avast Secure Browser 76.0.1659.101. The vulnerability is due to an insecure ACL set by CVE-2019-171917.5The Signal Private Messenger application before 4.47.7 for Android allows a caller to force a call to be answered, without callee user interCVE-2019-171929.8The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before aCVE-2019-171959.8Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crashCVE-2019-171979.8OpenEMR through 5.0.2 has SQL Injection in the Lifestyle demographic filter criteria in library/clinical_rules.php that affects library/patiCVE-2019-171997.5www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal (for reading arbitrary files) because of an unanchored regulaCVE-2019-17204.9A vulnerability in the XML API of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticatCVE-2019-172017.8FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to AdministratCVE-2019-172027.8FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to AdministratCVE-2019-172035.4TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.