VYPR
← All advisories
High severity7.2NVD Advisory· Published Feb 26, 2019· Updated Jun 17, 2026

CVE-2019-9181

CVE-2019-9181

Description

SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code.

Affected products

3
  • Top Think/Thinkphpinferred
    Range: = 2.3.1
  • SchoolCMS/SchoolCMS2 versions
    cpe:2.3:a:schoolcms:schoolcms:2.3.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:schoolcms:schoolcms:2.3.1:*:*:*:*:*:*:*
    • (no CPE)range: =2.3.1

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.