CVE-2020-10963

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.htmlThird Party Advisory, VDB Entry
https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/160243/Laravel-Administrator-4-File-Upload.htmlThird Party Advisory, VDB Entry
https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/Exploit, Third Party Advisory

Timeline

Published: Mar 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-109649.8Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a CVE-2020-109658.1Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the d CVE-2020-109666.5In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads t CVE-2020-109675.3In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpar CVE-2020-109688.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.CVE-2020-109698.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.J CVE-2020-10976.5<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacke CVE-2020-109718.8An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution o CVE-2020-109727.5An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No CVE-2020-109737.5An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh w CVE-2020-109747.5An issue was discovered affecting a backup feature where a crafted POST request returns the current configuration of the device in cleartext CVE-2020-109754.3GitLab EE/CE 10.8 to 12.9 is leaking metadata and comments on vulnerabilities to unauthorized users on the vulnerability feedback page.