ID CVE-2015-1587
Summary Unrestricted file upload vulnerability in file_to_index.php in Maarch LetterBox 2.8 and earlier and GEC/GED 1.4 and earlier allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a request to a predictable filename in tmp/. <a href="http://cwe.mitre.org/data/definitions/434.html">CWE-434: Unrestricted Upload of File with Dangerous Type</a>
References
Vulnerable Configurations
  • cpe:2.3:a:maarch:gec\/ged:*:*:*:*:*:*:*:*
    cpe:2.3:a:maarch:gec\/ged:*:*:*:*:*:*:*:*
  • cpe:2.3:a:maarch:letterbox:*:*:*:*:*:*:*:*
    cpe:2.3:a:maarch:letterbox:*:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 21-02-2015 - 01:33)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
exploit-db 35113
misc
osvdb 113928
Last major update 21-02-2015 - 01:33
Published 19-02-2015 - 15:59
Last modified 21-02-2015 - 01:33
Back to Top