PT-2008-1877 · Zerocms · Zerocms

Kingoftheworld · Published 2008-01-11 · Updated 2017-09-29 · CVE-2008-0233

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zero CMS versions 1.0 Alpha and earlier

Description The issue allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg. This enables attackers to potentially execute malicious code on the server.

Recommendations For Zero CMS versions 1.0 Alpha and earlier, consider restricting the upload of files to only necessary and validated types to prevent the execution of arbitrary files. As a temporary workaround, restrict access to the avatar upload feature until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0233

Affected Products

Zerocms

References · 3

• 🔥 https://exploit-db.com/exploits/4864 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0233 · Security Note
• http://packetstormsecurity.org/0801-exploits/zerocms-sql.txt · Note