PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16629
Reference (s):
- https://github.com/Gh0stF/phpok_cve/issues/1