CyberRota Analysis
AI-GeneratedThe OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7 is vulnerable to authenticated, privileged remote code execution due to inadequate file handling in the saveWatermark() function, which allows users to upload malicious files without proper validation. This flaw enables an authenticated core.manage user to upload a PHP file disguised as an image, leading to potential server compromise. Organizations using this extension should prioritize immediate patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.