CVE-2008-7026

EPSS 4.7%

Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension as an avatar, then accessing it via a direct request to the file in (1) student/avatars/ or (2) professor/avatars/.

Affected products

n/a · n/a

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/6633unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://forum.efrontlearning.net/viewtopic.php?f=1&t=271 https://exchange.xforce.ibmcloud.com/vulnerabilities/45574 https://www.exploit-db.com/exploits/6633 http://www.osvdb.org/54294 http://www.securityfocus.com/archive/1/496851/100/0/threaded http://www.securityfocus.com/bid/31491