CVE-2015-1604

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-1604
Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html Exploit
http://seclists.org/fulldisclosure/2015/Feb/50 Exploit
http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html Exploit
http://www.openwall.com/lists/oss-security/2015/02/13/11 Exploit
http://www.openwall.com/lists/oss-security/2015/02/14/1
http://www.openwall.com/lists/oss-security/2015/02/14/5
http://www.securityfocus.com/bid/72605 Exploit
https://github.com/kneecht/adminsystems/issues/1 Exploit
https://github.com/kneecht/adminsystems/releases/tag/4.0.2 Patch
http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html Exploit
http://seclists.org/fulldisclosure/2015/Feb/50 Exploit
http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html Exploit
http://www.openwall.com/lists/oss-security/2015/02/13/11 Exploit
http://www.openwall.com/lists/oss-security/2015/02/14/1
http://www.openwall.com/lists/oss-security/2015/02/14/5
http://www.securityfocus.com/bid/72605 Exploit
https://github.com/kneecht/adminsystems/issues/1 Exploit
https://github.com/kneecht/adminsystems/releases/tag/4.0.2 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:adminsystems_cms_project:adminsystems_cms:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:25

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html - Exploit () http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html - Exploit
References () http://seclists.org/fulldisclosure/2015/Feb/50 - Exploit () http://seclists.org/fulldisclosure/2015/Feb/50 - Exploit
References () http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html - Exploit () http://sroesemann.blogspot.de/2015/02/report-for-advisory-sroeadv-2015-14.html - Exploit
References () http://www.openwall.com/lists/oss-security/2015/02/13/11 - Exploit () http://www.openwall.com/lists/oss-security/2015/02/13/11 - Exploit
References () http://www.openwall.com/lists/oss-security/2015/02/14/1 - () http://www.openwall.com/lists/oss-security/2015/02/14/1 -
References () http://www.openwall.com/lists/oss-security/2015/02/14/5 - () http://www.openwall.com/lists/oss-security/2015/02/14/5 -
References () http://www.securityfocus.com/bid/72605 - Exploit () http://www.securityfocus.com/bid/72605 - Exploit
References () https://github.com/kneecht/adminsystems/issues/1 - Exploit () https://github.com/kneecht/adminsystems/issues/1 - Exploit
References () https://github.com/kneecht/adminsystems/releases/tag/4.0.2 - Patch () https://github.com/kneecht/adminsystems/releases/tag/4.0.2 - Patch
Information

Published : 2015-02-19 15:59

Updated : 2024-11-21 02:25

NVD link : CVE-2015-1604

Mitre link : CVE-2015-1604

CVE.ORG link : CVE-2015-1604

JSON object : View

Products Affected

adminsystems_cms_project

  • adminsystems_cms
CWE
CWE-20

Improper Input Validation