CyberRota Analysis
AI-GeneratedThe yii2-starter-kit versions up to 4.2.0 are vulnerable due to inadequate validation of file types during backend storage uploads, enabling authenticated managers to upload malicious PHP files. This flaw allows attackers with manager privileges to execute arbitrary code on the server, posing a significant risk to the integrity and security of the application. Organizations utilizing this framework should prioritize remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.