PT-2014-2912 · Sharetronix · Sharetronix

Publicado 2014-06-13 · Atualizado 2017-08-29 · CVE-2013-5353

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sharetronix versions 3.1.1.3, 3.1.1, and earlier

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. This is due to an unrestricted file upload vulnerability in the system/controllers/ajax/attachments.php file.

Recommendations For Sharetronix versions 3.1.1.3, 3.1.1, and earlier, consider restricting access to the system/controllers/ajax/attachments.php file until a fix is available. As a temporary workaround, consider disabling the file upload functionality in the affected file to prevent exploitation. Restrict access to directories where uploaded files are stored to minimize the risk of arbitrary code execution.

Correção

Identificadores relacionados

CVE-2013-5353

Produtos afetados

Sharetronix

Referências · 6

• http://secunia.com/secunia_research/2013-9 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-5353 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89502 · Nota
• http://securityfocus.com/bid/64102 · Nota
• http://osvdb.org/100604 · Nota
• http://secunia.com/advisories/53936 · Nota