CVE-2015-1604 Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extens...
MediumCVSS 6.5
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| adminsystems cms project adminsystems cms | <= 4.0.0 | No fix listed |
References
- packetstormsecurity.com exploit
- 20150213 Reflecting XSS vulnerabitlies, unrestricted file upload and underlaying CSRF in Landsknecht Adminsystems CMS v. 4.0.1 (DEV, beta version) exploit mailing-list
- sroesemann.blogspot.de exploit
- [oss-security] 20150213 CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF exploit mailing-list
- [oss-security] 20150213 Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF mailing-list
- [oss-security] 20150214 Re: CVE-Request -- Landsknecht Adminsystems v.4.0.1 (DEV, beta version) -- Reflecting XSS, unrestricted file-upload and underlaying CSRF mailing-list
- 72605 exploit vdb-entry
- github.com exploit
- github.com patch