CVE-2008-2833 admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload and execute arbitrary files in images/, via a nonzero value for the submit0 param...
HighCVSS 10.0
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
admin/upload.php in le.cms 1.4 and earlier allows remote attackers to bypass administrative authentication, and upload and execute arbitrary files in images/, via a nonzero value for the submit0 parameter in conjunction with filenames in the filename and upload parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| worldlevel le.cms | <= 1.4 | No fix listed |
References
- 30797 third-party-advisory vendor-advisory
- 29867 exploit vdb-entry
- 29872 vdb-entry
- lecms-upload-file-upload(43274) vdb-entry
- 5887 exploit