PT-2007-5675 · American Financing · American Financing Email Image Upload

Published 2007-08-23 · Updated 2008-11-15 · CVE-2007-4499

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions American Financing eMail Image Upload version 4.1

Description The issue concerns an unrestricted file upload vulnerability. This allows remote attackers to upload and execute arbitrary code. The specific vectors used for the attack are not specified.

Recommendations For version 4.1, restrict file uploads to only allow authorized users and validate the types of files being uploaded to prevent the execution of arbitrary code. As a temporary workaround, consider disabling the file upload functionality in output.php until a more comprehensive fix is available.

Fix

Related Identifiers

CVE-2007-4499

Affected Products

American Financing Email Image Upload

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-4499 · Security Note
• http://securityfocus.com/bid/25404 · Note
• http://osvdb.org/45827 · Note