cve/2019/CVE-2019-19576.md

CVE-2019-19576

Description

class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.

POC

Reference

• http://packetstormsecurity.com/files/155577/Verot-2.0.3-Remote-Code-Execution.html
• https://github.com/jra89/CVE-2019-19576
• https://medium.com/@jra8908/cve-2019-19576-e9da712b779

Github

• https://github.com/0xT11/CVE-POC
• https://github.com/ARPSyndicate/cvemon
• https://github.com/developer3000S/PoC-in-GitHub
• https://github.com/hectorgie/PoC-in-GitHub
• https://github.com/jra89/CVE-2019-19576
• https://github.com/jra89/CVE-2019-19634