PT-2011-5160 · Quixplorer · Quixplorer

Krhr_Krhr + 1 · Publicado 2011-12-25 · Atualizado 2017-08-29 · CVE-2011-5005

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions QuiXplorer versions 2.3 and earlier

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension using the "upload action" to "index.php", then accessing it via a direct request to the file in an unspecified directory.

Recommendations For QuiXplorer versions 2.3 and earlier, consider restricting or disabling the file upload functionality, specifically the upload action to "index.php", until a fix is available. Additionally, restrict access to directories where uploaded files are stored to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2011-5005

Produtos afetados

Quixplorer

Referências · 5

• 🔥 http://exploit-db.com/exploits/18118 · Exploit
• 🔥 https://exploit-db.com/exploits/18118 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-5005 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/71323 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5005 · Nota