CVE-2011-2745 upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users....
MediumCVSS 6.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| chyrp | <= 2.0 | No fix listed |
References
- 8314 third-party-advisory
- www.justanotherhacker.com exploit
- [oss-security] 20110713 [oCERT-2011-001] Chyrp input sanitization errors mailing-list
- [oss-security] 20110713 Re: [oCERT-2011-001] Chyrp input sanitization errors exploit mailing-list
- 48672 exploit vdb-entry