PT-2005-1778 · Xoops · Xoops

Published 2005-03-13 · Updated 2017-07-11 · CVE-2005-0743

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions XOOPS versions 2.0.9.2 and earlier

Description The issue concerns the custom avatar uploading feature, specifically the uploader.php file, which does not filter file extensions. This allows remote attackers to upload arbitrary PHP scripts.

Recommendations For XOOPS versions 2.0.9.2 and earlier, consider disabling the custom avatar uploading feature, specifically the uploader.php file, until a fix is available to prevent the upload of arbitrary PHP scripts.

Fix

Related Identifiers

CVE-2005-0743

Affected Products

Xoops

References · 7

• http://xoops.org/modules/news/article.php?storyid=2114 · Patch
• http://securityfocus.com/archive/1/392626 · Patch
• http://secunia.com/advisories/14520 · Vendor Advisory
• http://securityfocus.com/bid/12754 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-0743 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0743 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19634 · Note