CVE-2020-28688 - OpenCVE

The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

AV:N/AC:L/Au:S/C:C/I:C/A:C

Vendors & Products
CPE Configurations

Vendors	Products
Artworks Gallery In Php\, Css\, Javascript\, And Mysql Project	Artworks Gallery In Php\, Css\, Javascript\, And Mysql

Configuration 1 [-]

cpe:2.3:a:artworks_gallery_in_php\,_css\,_javascript\,_and_mysql_project:artworks_gallery_in_php\,_css\,_javascript\,_and_mysql:1.0:*:*:*:*:*:*:*

References

Link	Resource
https://code-projects.org/artworks-gallery-in-php-css-javascript-and-mysql-free-download/	Product Vendor Advisory
https://packetstormsecurity.com/files/160095/Artworks-Gallery-1.0-Shell-Upload.html	Exploit Third Party Advisory VDB Entry

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2020-11-17T13:14:35

Updated: 2020-11-17T13:14:35

Reserved: 2020-11-16T00:00:00

Link: CVE-2020-28688

JSON object: View

NVD Information

Status : Analyzed

Published: 2020-11-17T14:15:11.540

Modified: 2020-12-02T18:27:46.150

Link: CVE-2020-28688

JSON object: View

Redhat Information

No data.

CWE

CWE-434

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:artworks_gallery_in_php\\,_css\\,_javascript\\,_and_mysql_project:artworks_gallery_in_php\\,_css\\,_javascript\\,_and_mysql:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "16866607-5C8C-4091-A5F2-FBC8D4FF4169", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files."}, {"lang": "es", "value": "La funcionalidad add artwork en ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT AND MYSQL versi\u00f3n 1.0, permite a atacantes remotos cargar archivos"}], "id": "CVE-2020-28688", "lastModified": "2020-12-02T18:27:46.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-11-17T14:15:11.540", "references": [{"source": "cve@mitre.org", "tags": ["Product", "Vendor Advisory"], "url": "https://code-projects.org/artworks-gallery-in-php-css-javascript-and-mysql-free-download/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://packetstormsecurity.com/files/160095/Artworks-Gallery-1.0-Shell-Upload.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}