CVE-2018-20166

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed case, such as the .pHp extension.

• CWE-434

• https://pentest.com.tr/exploits/Rukovoditel-Project-Management-CRM-2-3-1-Authenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46011Exploit, Third Party Advisory, VDB Entry
• https://pentest.com.tr/exploits/Rukovoditel-Project-Management-CRM-2-3-1-Authenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/46011Exploit, Third Party Advisory, VDB Entry

Published

Jan 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-20159i-doit open 1.11.2 allows Remote Code Execution because ZIP …
• CVE-2018-20160ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbr…
• CVE-2018-20161A design flaw in the BlinkForHome (aka Blink For Home) Sync …
• CVE-2018-20162Digi TransPort LR54 4.4.0.26 and possible earlier devices ha…
• CVE-2018-20164An issue was discovered in regex.yaml (aka regexes.yaml) in …
• CVE-2018-20165Cross-site scripting (XSS) vulnerability in OpenText Portal …
• CVE-2018-20167Terminology before 1.3.1 allows Remote Code Execution becaus…
• CVE-2018-20168Google gVisor before 2018-08-22 reuses a pagetable in a diff…
• CVE-2018-20169An issue was discovered in the Linux kernel before 4.19.9. T…6.8
• CVE-2018-20170OpenStack Keystone through 14.0.1 has a user enumeration vul…
• CVE-2018-20171An issue was discovered in Nagios XI before 5.5.8. The url p…
• CVE-2018-20172An issue was discovered in Nagios XI before 5.5.8. The rss_u…