PT-2010-1627 · Simplicity · Phpsimplicity

Master Mind · Publicado 2010-04-27 · Atualizado 2017-08-17 · CVE-2009-4818

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPSimplicity Simplicity oF Upload version 1.3.2

Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension. This can be achieved by uploading a file such as .php.gif to the upload.php endpoint.

Recommendations For version 1.3.2, consider restricting or validating file uploads in the upload.php script to prevent uploading files with double extensions, and ensure that only authorized users can upload files.

Exploit

Correção

Identificadores relacionados

CVE-2009-4818

Produtos afetados

Phpsimplicity

Referências · 5

• 🔥 https://exploit-db.com/exploits/10568 · Exploit
• 🔥 http://exploit-db.com/exploits/10568 · Exploit
• http://securityfocus.com/bid/37424 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54952 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4818 · Nota de Segurança