CVE-2008-2267: Input Validation
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2267?
CVE-2008-2267 is considered a critical vulnerability that allows remote code execution.
How do I fix CVE-2008-2267?
To fix CVE-2008-2267, upgrade CMS Made Simple to version 1.2.5 or later.
What versions of CMS Made Simple are affected by CVE-2008-2267?
CVE-2008-2267 affects CMS Made Simple version 1.2.4 and earlier.
What types of files can be uploaded to exploit CVE-2008-2267?
Files with names ending in .jsp, .php3, .cgi, .dhtml, .phtml, .php5, or .jar can be uploaded to exploit CVE-2008-2267.
Is there a workaround for CVE-2008-2267?
There are no specific workarounds published for CVE-2008-2267, so upgrading to a secure version is recommended.