PT-2014-2912 · Sharetronix · Sharetronix

Published 2014-06-13 · Updated 2017-08-29 · CVE-2013-5353

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sharetronix versions 3.1.1.3, 3.1.1, and earlier

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. This is due to an unrestricted file upload vulnerability in the system/controllers/ajax/attachments.php file.

Recommendations For Sharetronix versions 3.1.1.3, 3.1.1, and earlier, consider restricting access to the system/controllers/ajax/attachments.php file until a fix is available. As a temporary workaround, consider disabling the file upload functionality in the affected file to prevent exploitation. Restrict access to directories where uploaded files are stored to minimize the risk of arbitrary code execution.

Fix

Related Identifiers

CVE-2013-5353

Affected Products

Sharetronix

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-5353 · Security Note
• http://secunia.com/secunia_research/2013-9 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89502 · Note
• http://securityfocus.com/bid/64102 · Note
• http://osvdb.org/100604 · Note
• http://secunia.com/advisories/53936 · Note