Goople CMS '/win/content/upload.php' Arbitrary File Upload Vulnerability

Bugtraq ID:	32428
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 23 2008 12:00AM
Updated:	Nov 24 2008 08:33PM
Credit:	x0r
Vulnerable:	Goople CMS Goople CMS 1.7
Not Vulnerable:

Goople CMS '/win/content/upload.php' Arbitrary File Upload Vulnerability

Goople CMS is prone to a vulnerability that lets attackers upload arbitrary files because it fails to properly verify the file extensions of uploaded files.

An attacker can exploit this issue to execute malicious code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Goople CMS 1.7 is vulnerable to this issue; other versions may also be affected.

Goople CMS '/win/content/upload.php' Arbitrary File Upload Vulnerability

Attackers can exploit this issue via a browser.

Goople CMS '/win/content/upload.php' Arbitrary File Upload Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Goople CMS '/win/content/upload.php' Arbitrary File Upload Vulnerability

References:

• Goople CMS Project Page (Goople CMS)