PT-2007-2656 · Sitex · Sitex

Published 2007-03-03 · Updated 2018-10-16 · CVE-2007-1235

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions sitex (affected versions not specified)

Description The issue concerns an unrestricted file upload vulnerability. Remote attackers can upload arbitrary PHP code by using an avatar filename with a double extension, such as .php.jpg. This filename fails verification and is saved as a .php file, allowing potential execution of malicious code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-1235

Affected Products

Sitex

References · 4

• 🔥 http://securityreason.com/securityalert/2373 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1235 · Security Note
• http://osvdb.org/33157 · Note
• http://securityfocus.com/archive/1/461305/100/0/threaded · Note