PT-2007-2656 · Sitex · Sitex

Publicado 2007-03-03 · Atualizado 2018-10-16 · CVE-2007-1235

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sitex (affected versions not specified)

Description The issue concerns an unrestricted file upload vulnerability. Remote attackers can upload arbitrary PHP code by using an avatar filename with a double extension, such as .php.jpg. This filename fails verification and is saved as a .php file, allowing potential execution of malicious code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-1235

Produtos afetados

Sitex

Referências · 4

• 🔥 http://securityreason.com/securityalert/2373 · Exploit
• http://osvdb.org/33157 · Nota
• http://securityfocus.com/archive/1/461305/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1235 · Nota de Segurança