PT-2007-6719 · Efileman · Efileman

Published 2007-10-30 · Updated 2018-10-15 · CVE-2007-5734

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions eFileMan versions 7.1.0.87 through 7.1.0.88

Description The issue allows remote attackers to upload arbitrary files. This is achieved by accessing the "upload.cgi" endpoint from "upload.html" with unspecified vectors, resulting in files being uploaded to the "uploads/upload file." destination.

Recommendations For versions 7.1.0.87 and 7.1.0.88, consider restricting access to the "upload.cgi" endpoint until a patch is available. As a temporary workaround, restrict the ability to upload files to the "uploads/upload file." destination to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-5734

Affected Products

Efileman

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5734 · Security Note
• http://securityfocus.com/bid/26184 · Note
• http://securityreason.com/securityalert/3323 · Note
• http://osvdb.org/39013 · Note
• http://securityfocus.com/archive/1/482683/100/0/threaded · Note