Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execut…

Published 9 y ago 2017-10-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

96.4%

percentile 100%

Public exploits

Exploit-DB

Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/.

Exploit prediction (EPSS)

96.39% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

EDB-43519 phpCollab 2.5.1 - File Upload (Metasploit) · remote · 2018-01-11
EDB-42934 phpCollab 2.5.1 - Arbitrary File Upload · webapps · 2017-10-02

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	6.5	`AV:N/AC:L/Au:S/C:P/I:P/A:P`

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type

References

sysdream.com /news/lab/2017-09-29-cve-2017-6090-phpcollab-2-5-1-arbitrary-file-upload-unauthenticated/ · x_refsource_MISC, x_transferred
exploit-db.com /exploits/42934/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
exploit-db.com /exploits/43519/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2017-6090
NVD: CVE-2017-6090

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.