PT-2017-7233 · Yeager · Yeager Cms

P. Morimoto · Published 2017-08-07 · Updated 2018-10-09 · CVE-2015-7571

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Yeager CMS version 1.2.1

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension, due to an unrestricted file upload vulnerability.

Recommendations For Yeager CMS version 1.2.1, update to a newer version that contains a fix for this issue, or as a temporary workaround, consider restricting file uploads to only allow non-executable file extensions.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2015-7571

Affected Products

Yeager Cms

References · 5

• 🔥 https://exploit-db.com/exploits/39436 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2016/Feb/44 · Exploit
• 🔥 http://packetstormsecurity.com/files/135716/Yeager-CMS-1.2.1-File-Upload-SQL-Injection-XSS-SSRF.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-7571 · Security Note
• http://securityfocus.com/archive/1/537493/100/0/threaded · Note