| Package | Affected versions | Patched versions |
|---|---|---|
| humatrix 7 | = 1.0.0.203= 1.0.0.681 |
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parameter. Moreover, the attacker can upload executable content (e.g., asp or aspx) for executing OS commands on the server.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free