ActiveCampaign 1-2-All FCKEditor Module Remote Code Execution Vulnerability

Bugtraq ID:	23792
Class:	Input Validation Error
CVE:	CVE-2007-2630
Remote:	Yes
Local:	No
Published:	May 03 2007 12:00AM
Updated:	May 07 2015 05:39PM
Credit:	John McGuire is credited with discovering this vulnerability.
Vulnerable:	ActiveCampaign 1-2-All Broadcast Email 4.53.13 ActiveCampaign 1-2-All Broadcast Email 4.5
Not Vulnerable:	ActiveCampaign 1-2-All Broadcast Email 4.54

ActiveCampaign 1-2-All FCKEditor Module Remote Code Execution Vulnerability

1-2-All is prone to a remote code-execution vulnerability because the application fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary PHP code on an affected computer with the privileges of the webserver process.

UPDATE: The vendor states that an attacker must be logged in as ADMIN to exploit this issue.

This issue affects 1-2-All 4.5 through 4.53.13; other versions may also be affected.

ActiveCampaign 1-2-All FCKEditor Module Remote Code Execution Vulnerability

Attackers may exploit this issue through a browser.

ActiveCampaign 1-2-All FCKEditor Module Remote Code Execution Vulnerability

Solution:
The vendor has released version 4.54 to address this issue. Please contact the vendor for information on how to obtain the updated version.

ActiveCampaign 1-2-All FCKEditor Module Remote Code Execution Vulnerability

References:

• ActiveCampaign Home Page (ActiveCampaign)
  
• Re: 12All File Upload Vulnerability (Active Campaign)