PT-2020-7749 · Helpdezk · Helpdezk
Published
2020-01-03
·
Updated
2020-01-15
·
CVE-2014-8337
CVSS v2.0
7.5
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
HelpDEZk versions 1.0.1 and earlier
Description
The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the
uploadify.php script, and then accessing it via a direct request to the file in the directory specified by the folder parameter. This is due to an unrestricted file upload vulnerability.Recommendations
For HelpDEZk versions 1.0.1 and earlier, as a temporary workaround, consider disabling the file upload functionality in the
uploadify.php script until a patch is available. Restrict access to the uploadify.php script to minimize the risk of exploitation. Avoid using the folder parameter in the affected script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helpdezk