PT-2017-7233 · Yeager · Yeager Cms

P. Morimoto · Publicado 2017-08-07 · Atualizado 2018-10-09 · CVE-2015-7571

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yeager CMS version 1.2.1

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension, due to an unrestricted file upload vulnerability.

Recommendations For Yeager CMS version 1.2.1, update to a newer version that contains a fix for this issue, or as a temporary workaround, consider restricting file uploads to only allow non-executable file extensions.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2015-7571

Produtos afetados

Yeager Cms

Referências · 5

• 🔥 https://exploit-db.com/exploits/39436 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Feb/44 · Exploit
• 🔥 http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html · Exploit
• http://securityfocus.com/archive/1/537493/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7571 · Nota de Segurança