CVE-2018-17553

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.

Un problema de "subida sin restricción de archivos con tipos peligrosos" con salto de directorio en navigate_upload.php en Naviwebs Navigate CMS 2.8 permite que atacantes autenticados logren ejecutar código de forma remota mediante una petición POST con engine=picnik y id=../../../navigate_info.php.