Limbo CMS Frontpage Arbitrary File Upload Vulnerability
BID:20044
CVE-2006-4859 |Info
Limbo CMS Frontpage Arbitrary File Upload Vulnerability
| Bugtraq ID: | 20044 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 15 2006 12:00AM |
| Updated: | Sep 16 2006 12:02AM |
| Credit: | rgod is credited with the discovery of this vulnerability. |
| Vulnerable: |
Limbo CMS Limbo CMS 1.0.4 .2 Limbo CMS Limbo CMS 1.0.4 .1 Limbo CMS Limbo CMS 1.0.4.2L |
| Not Vulnerable: | |
Discussion
Limbo CMS Frontpage Arbitrary File Upload Vulnerability
Limbo CMS is prone to an arbitrary file-upload vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit this issue to upload and execute arbitrary PHP commands on the vulnerable computer in the context of the webserver process.
Limbo CMS is prone to an arbitrary file-upload vulnerability because the application fails to properly sanitize user-supplied input.
An attacker can exploit this issue to upload and execute arbitrary PHP commands on the vulnerable computer in the context of the webserver process.
Exploit / POC
Limbo CMS Frontpage Arbitrary File Upload Vulnerability
Attackers can exploit this issue via a web client.
The following sample exploit is available:
Attackers can exploit this issue via a web client.
The following sample exploit is available:
Solution / Fix
Limbo CMS Frontpage Arbitrary File Upload Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].