PT-2010-1627 · Simplicity · Phpsimplicity

Master Mind · Published 2010-04-27 · Updated 2017-08-17 · CVE-2009-4818

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPSimplicity Simplicity oF Upload version 1.3.2

Description The issue allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension. This can be achieved by uploading a file such as .php.gif to the upload.php endpoint.

Recommendations For version 1.3.2, consider restricting or validating file uploads in the upload.php script to prevent uploading files with double extensions, and ensure that only authorized users can upload files.

Exploit

Fix

Related Identifiers

CVE-2009-4818

Affected Products

Phpsimplicity

References · 5

• 🔥 https://exploit-db.com/exploits/10568 · Exploit
• 🔥 http://exploit-db.com/exploits/10568 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-4818 · Security Note
• http://securityfocus.com/bid/37424 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54952 · Note