CVE-2008-5663 Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load...
HighCVSS 9.0
EPSS 6.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple unrestricted file upload vulnerabilities in Kusaba 1.0.4 and earlier allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension using (1) load_receiver.php or (2) a shipainter action to paint_save.php, then accessing the uploaded file via a direct request to this file in their user directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kusaba | <= 1.0.4 | No fix listed |
References
- 4782 third-party-advisory
- 31668 vdb-entry
- 31685 vdb-entry vendor-advisory
- kusaba-paintsave-code-execution(45793) vdb-entry
- kusaba-loadreceiver-code-execution(45794) vdb-entry
- 6706 exploit
- 6711 exploit