TYPO3 Job Fair Extension CVE-2015-4606 Arbitrary File Upload Vulnerability
BID:75238
Info
TYPO3 Job Fair Extension CVE-2015-4606 Arbitrary File Upload Vulnerability
| Bugtraq ID: | 75238 |
| Class: | Input Validation Error |
| CVE: |
CVE-2015-4606 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 15 2015 12:00AM |
| Updated: | Jun 15 2015 12:00AM |
| Credit: | Torben Hansen |
| Vulnerable: |
Typo3 Job Fair 1.0.0 |
| Not Vulnerable: |
Typo3 Job Fair 1.0.1 |
Discussion
TYPO3 Job Fair Extension CVE-2015-4606 Arbitrary File Upload Vulnerability
The Job Fair extension for TYPO3 is prone to an arbitrary-file-upload vulnerability because it fails to adequately validate user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the Web server process.
Job Fair 1.0.0 and prior are vulnerable.
The Job Fair extension for TYPO3 is prone to an arbitrary-file-upload vulnerability because it fails to adequately validate user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the Web server process.
Job Fair 1.0.0 and prior are vulnerable.
Exploit / POC
TYPO3 Job Fair Extension CVE-2015-4606 Arbitrary File Upload Vulnerability
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
TYPO3 Job Fair Extension CVE-2015-4606 Arbitrary File Upload Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.