CVE-2020-10963

CVE-2020-10963 is an unrestricted file upload vulnerability affecting FrozenNode Laravel-Administrator versions through 5.0.12. This flaw allows an authenticated attacker to upload malicious PHP code disguised within a GIF image with a .php extension, leading to Remote Code Execution (RCE). The vulnerability is rated as High severity (CVSS 7.2), indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability, requiring high privileges for exploitation. While not listed on CISA's KEV catalog or having Metasploit/Nuclei modules, an authenticated exploit is publicly available on ExploitDB. Despite its severity and exploit availability, there is currently no evidence of active exploitation, and it has received minimal community discussion or media coverage.