PT-2009-5498 · Anantasoft · Anantasoft Gazelle Cms

Romancyxhacker · Publicado 2009-09-11 · Atualizado 2017-09-19 · CVE-2009-3182

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Anantasoft Gazelle CMS version 1.0

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the /admin/editor/filemanager/browser.html endpoint, and then accessing it via a direct request to the file in user/File/. This is due to an unrestricted file upload vulnerability.

Recommendations For Anantasoft Gazelle CMS version 1.0, restrict access to the browser.html file in the admin/editor/filemanager directory to prevent unauthorized file uploads. As a temporary workaround, consider disabling the file upload functionality in the browser.html file until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-3182

Produtos afetados

Anantasoft Gazelle Cms

Referências · 5

• 🔥 http://exploit-db.com/exploits/9433 · Exploit
• 🔥 https://exploit-db.com/exploits/9433 · Exploit
• 🔥 https://exploit-db.com/exploits/9425 · Exploit
• http://secunia.com/advisories/33686 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-3182 · Nota de Segurança