PT-2013-1962 · Atomemaxsite · Atomymaxsite

Published 2013-01-08 · Updated 2013-01-15 · CVE-2012-6498

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Atomymaxsite versions 2.5 and earlier

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the index.php file, and then accessing it via a direct request to the file. This has been exploited in the wild.

Recommendations For versions 2.5 and earlier, update to a version later than 2.5 to resolve the issue. As a temporary workaround, consider restricting file uploads in index.php to prevent exploitation.

Fix

Related Identifiers

CVE-2012-6498

Affected Products

Atomymaxsite

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-6498 · Security Note
• http://thaicert.or.th/alerts/admin/2012/al2012ad025.html · Note
• http://youtube.com/watch?v=CfvTCSS3LGY · Note