cve/2019/CVE-2019-16113.md

CVE-2019-16113

Description

Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.

POC

Reference

• http://packetstormsecurity.com/files/155295/Bludit-Directory-Traversal-Image-File-Upload.html
• http://packetstormsecurity.com/files/157988/Bludit-3.9.12-Directory-Traversal.html
• http://packetstormsecurity.com/files/158569/Bludit-3.9.2-Directory-Traversal.html
• https://github.com/bludit/bludit/issues/1081

Github

• https://github.com/0xConstant/CVE-2019-11447
• https://github.com/0xConstant/CVE-2019-16113
• https://github.com/0xConstant/CVE-2019-16113_
• https://github.com/0xConstant/ExploitDevJourney
• https://github.com/0xConstant/Gym-Management-1.0-unauthenticated-RCE
• https://github.com/0xT11/CVE-POC
• https://github.com/0xkasra/CVE-2019-16113
• https://github.com/0xkasra/CVE-2019-16113_
• https://github.com/0xkasra/ExploitDevJourney
• https://github.com/ARPSyndicate/cvemon
• https://github.com/DXY0411/CVE-2019-16113
• https://github.com/Kenun99/CVE-2019-16113-Dockerfile
• https://github.com/cocomelonc/vulnexipy
• https://github.com/cybervaca/CVE-2019-16113
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/hg8/CVE-2019-16113-PoC
• https://github.com/itsjeffersonli/CVE-2019-16113
• https://github.com/mind2hex/CVE-2019-16113
• https://github.com/superlink996/chunqiuyunjingbachang
• https://github.com/ynots0ups/CVE-2019-16113
• https://github.com/zeroxninety/CVE-2019-16113-PoC