CVE-2008-2686 webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and...
HighCVSS 7.5
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| flux cms | <= 1.50 | No fix listed |
| flux cms | = 1.2 | No fix listed |
| flux cms | = 1.3 | No fix listed |
| flux cms | = 1.4 | No fix listed |
| flux cms | = 1.31 | No fix listed |
References
- 29618 exploit vdb-entry
- fluxcms-loadsave-file-overwrite(42961) vdb-entry
- 5767 exploit