CVE-2012-4472: Medium severity David Alkire Drag \& Drop Gallery vulnerability
Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the filedir parameter.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4472?
CVE-2012-4472 is considered a high-severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2012-4472?
To fix CVE-2012-4472, upgrade the Drag & Drop Gallery module to version 6.x-1.6 or later.
What type of attacks can CVE-2012-4472 facilitate?
CVE-2012-4472 can facilitate remote code execution attacks by allowing attackers to upload malicious files.
Which versions of the Drag & Drop Gallery module are affected by CVE-2012-4472?
CVE-2012-4472 affects versions 6.x-1.5 and earlier of the Drag & Drop Gallery module.
What is the primary mechanism of the vulnerability in CVE-2012-4472?
The primary mechanism of CVE-2012-4472 is unrestricted file upload, permitting executable files to be uploaded.