Security readout for executives and security teams
Plain-English summary
This issue lets a remote attacker upload arbitrary files through the add artwork feature. If the uploaded file is stored where the web server can run or serve it, the site could be defaced, abused to host malicious content, or potentially compromised. Sources do not provide CVSS, a named patch, or evidence of active exploitation.
Executive priority
Treat as urgent for any internet-facing deployment because arbitrary uploads can quickly become site compromise. If the product is present, prioritize containment and replacement guidance review before routine backlog work.
Technical view
CVE-2020-28688 affects Artworks Gallery in PHP, CSS, JavaScript, and MySQL 1.0. The vulnerable add artwork functionality does not adequately restrict uploaded files. The public references identify arbitrary file upload and a shell-upload write-up, but do not provide CVSS metrics, CWE mapping, vendor CPEs, or remediation details.
Likely exposure
Likely exposure is limited to deployments of Artworks Gallery 1.0 with the add artwork upload feature reachable by remote users. The bundle does not establish affected CPEs, other versions, authentication requirements, or whether common hosted instances are exposed.
Exploitation context
A public Packet Storm reference exists for a shell-upload issue, indicating public exploit knowledge. The CVE is not listed as KEV in the provided bundle, and the sources do not state active exploitation in the wild.
Researcher notes
The evidence is thin: no CVSS, CWE, CPE, patch statement, or authentication context is included. Analysis should avoid assuming broader product impact. Focus validation on reachable Artworks Gallery 1.0 upload surfaces and server-side execution controls.
Mitigation direction
- Check the project or vendor page for any replacement release or guidance.
- Remove or restrict access to the add artwork upload feature if not required.
- Block execution of uploaded files in upload directories at the web server layer.
- Enforce strict allowlists for image types and store uploads outside executable paths.
- Review existing uploaded files for unexpected scripts or executable content.
Validation and detection
- Inventory any Artworks Gallery 1.0 deployments, including test and demo sites.
- Confirm whether the add artwork feature is remotely reachable and who can access it.
- Inspect upload directories for executable file types or suspicious recently added files.
- Review web logs for unusual upload activity or requests to uploaded scripts.
- Document whether compensating controls block execution from upload storage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-28688 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://code-projects.org/artworks-gallery-in-php-css-javascript-and-mysql-free-download/CVE reference · x_refsource_MISC
- https://packetstormsecurity.com/files/160095/Artworks-Gallery-1.0-Shell-Upload.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.