CVE-2006-0695: High severity Ansilove Ansilove vulnerability
Ansilove before 1.03 does not filter uploaded file extensions, which allows remote attackers to execute arbitrary code by uploading arbitrary files with dangerous extensions, then accessing them directly in the upload directory.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it without authentication if they can upload files and then access files in the upload directory.
What conditions are required for successful exploitation?
The application must accept an uploaded file with a dangerous extension without filtering it, and the uploaded file must be directly reachable through the upload directory.
Is there a fix available?
Yes. A patch is available; the affected versions are Ansilove releases before 1.03.
What can be done if patching is delayed?
Restrict or disable file uploads where possible, filter or reject dangerous file extensions, and prevent direct execution or access of uploaded files from the upload directory.