CVE-2008-2742: Input Validation
Unrestricted file upload in the mcpuk file editor (atk/attributes/fck/editor/filemanager/browser/mcpuk/connectors/php/config.php) in Achievo 1.2.0 through 1.3.2 allows remote attackers to execute arbitrary code by uploading a file with .php followed by a safe extension, then accessing it via a direct request to the file in the Achievo root directory. NOTE: this is only a vulnerability in environments that support multiple extensions, such as Apache with the modmime module enabled.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2742?
CVE-2008-2742 is considered to have a critical severity due to the potential for remote code execution.
How do I fix CVE-2008-2742?
To fix CVE-2008-2742, upgrade to Achievo version 1.3.3 or later, which includes the necessary security patches.
What are the affected versions of Achievo for CVE-2008-2742?
The affected versions of Achievo for CVE-2008-2742 are 1.2.0 through 1.3.2.
What type of attack does CVE-2008-2742 enable?
CVE-2008-2742 enables remote attackers to execute arbitrary code on the server through unrestricted file uploads.
What component is vulnerable in CVE-2008-2742?
The vulnerability in CVE-2008-2742 exists in the mcpuk file editor within the Achievo application.