VYPR
← All advisories
High severity7.0NVD Advisory· Published Jul 30, 2017· Updated Jun 17, 2026

CVE-2017-11756

CVE-2017-11756

Description

In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=config_upload, and then using user.php/music/add/ to upload the code.

Affected products

2
  • Earcms/Ear Music2 versions
    cpe:2.3:a:earcms:ear_music:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:earcms:ear_music:*:*:*:*:*:*:*:*range: <=4.1
    • (no CPE)range: <=4.1 build 20170710

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.