CVE-2008-2267: Input Validation
First published: Fri May 16 2008(Updated: )
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CMS Made Simple CMS Made Simple | =1.2.4 | |
| CMS Made Simple | =1.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125/
- http://www.attrition.org/pipermail/vim/2008-May/001978.html
- http://www.securityfocus.com/bid/29170
- http://secunia.com/advisories/30208
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42371
- https://www.exploit-db.com/exploits/5600
Frequently Asked Questions
What is the severity of CVE-2008-2267?
CVE-2008-2267 is considered a critical vulnerability that allows remote code execution.
How do I fix CVE-2008-2267?
To fix CVE-2008-2267, upgrade CMS Made Simple to version 1.2.5 or later.
What versions of CMS Made Simple are affected by CVE-2008-2267?
CVE-2008-2267 affects CMS Made Simple version 1.2.4 and earlier.
What types of files can be uploaded to exploit CVE-2008-2267?
Files with names ending in .jsp, .php3, .cgi, .dhtml, .phtml, .php5, or .jar can be uploaded to exploit CVE-2008-2267.
Is there a workaround for CVE-2008-2267?
There are no specific workarounds published for CVE-2008-2267, so upgrading to a secure version is recommended.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/author
- agent/weakness
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/cms made simple
- canonical/cms made simple cms made simple
- version/cms made simple cms made simple/1.2.4
- canonical/cms made simple
- version/cms made simple/1.2.4