CVE-2013-1668 - The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file

Back Back to CVE browser

HIGH

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file

Published May 23, 2014

8.5

HIGH

CVSS 2.0

EPSS 6.98%

Description

The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (8)

http://archives.neohapsis.com/archives/bugtraq/2013-03/0033.html
mailing-listx_refsource_BUGTRAQ
http://osvdb.org/90927
vdb-entryx_refsource_OSVDB
http://www.coscms.org/blog/view/4/Version-1.822
x_refsource_CONFIRM
http://www.exploit-db.com/exploits/24629
exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/58332
vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-1695
Advisory
https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c
x_refsource_CONFIRM
https://www.htbridge.com/advisory/HTB23145
x_refsource_MISC

Link	Providers	Tags
http://archives.neohapsis.com/archives/bugtraq/2013-03/0033.html		mailing-listx_refsource_BUGTRAQ
http://osvdb.org/90927		vdb-entryx_refsource_OSVDB
http://www.coscms.org/blog/view/4/Version-1.822		x_refsource_CONFIRM
http://www.exploit-db.com/exploits/24629		exploitx_refsource_EXPLOIT-DB
http://www.securityfocus.com/bid/58332		vdb-entryx_refsource_BIDExploit
https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-1695		Advisory
https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c		x_refsource_CONFIRM
https://www.htbridge.com/advisory/HTB23145		x_refsource_MISC