CVE-2008-3592 Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file wit...
HighCVSS 8.5
EPSS 6.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| 21degrees symphony | <= 1.7.01 | No fix listed |
| 21degrees symphony | = 1.1 | No fix listed |
| 21degrees symphony | = 1.5 | No fix listed |
| 21degrees symphony | = 1.5.05 | No fix listed |
| 21degrees symphony | = 1.5.06 | No fix listed |
| 21degrees symphony | = 1.6.02 | No fix listed |
| 21degrees symphony | = 1.7 | No fix listed |
References
- overture21.com patch
- 31293 patch third-party-advisory vendor-advisory
- 4137 third-party-advisory
- symphony-file-upload(44432) vdb-entry
- 6177 exploit