CVE-2011-1329 WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstr...
MediumCVSS 6.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
WalRack 1.x before 1.1.9 and 2.x before 2.0.7 does not properly restrict file uploads, which allows remote attackers to execute arbitrary PHP code via vectors involving a double extension, as demonstrated by a .php.zzz file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| walrus digit walrack | = 1.0.1 | No fix listed |
| walrus digit walrack | = 1.1.1 | No fix listed |
| walrus digit walrack | = 1.1.2 | No fix listed |
| walrus digit walrack | = 1.1.3 | No fix listed |
| walrus digit walrack | = 1.1.4 | No fix listed |
| walrus digit walrack | = 1.1.5 | No fix listed |
| walrus digit walrack | = 1.1.6 | No fix listed |
| walrus digit walrack | = 1.1.7 | No fix listed |
| walrus digit walrack | = 1.1.8 | No fix listed |
| walrus digit walrack | = 2.0.1 | No fix listed |
| walrus digit walrack | = 2.0.2 | No fix listed |
| walrus digit walrack | = 2.0.3 | No fix listed |
| walrus digit walrack | = 2.0.4 | No fix listed |
| walrus digit walrack | = 2.0.5 | No fix listed |
| walrus digit walrack | = 2.0.6 | No fix listed |
References
- digit.que.ne.jp patch
- digit.que.ne.jp patch
- jvn.jp
- JVN#46984044 third-party-advisory
- JVNDB-2011-000032 third-party-advisory
- 48001 vdb-entry
- walrack-uploaded-files-code-exec(67641) vdb-entry