CVE

Id
23174  
CVE No.
CVE-2006-7070  
Status
Candidate  
Description
Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.  
Phase
Assigned (20070227)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
223274 23174 CVE-2006-7070 BUGTRAQ:20060725 Etomite CMS <= 0.6.1 "rfiles.php" remote command execution  View
223275 23174 CVE-2006-7070 URL:http://www.securityfocus.com/archive/1/archive/1/441202/100/0/threaded  View
223276 23174 CVE-2006-7070 MILW0RM:2072  View
223277 23174 CVE-2006-7070 URL:http://www.milw0rm.com/exploits/2072  View
223278 23174 CVE-2006-7070 MISC:http://retrogod.altervista.org/etomite_061_cmd.html  View
223279 23174 CVE-2006-7070 CONFIRM:http://www.etomite.org/forums/index.php?showtopic=5757&st=0&p=35605&#entry35605  View
223280 23174 CVE-2006-7070 BID:19157  View
223281 23174 CVE-2006-7070 URL:http://www.securityfocus.com/bid/19157  View
223282 23174 CVE-2006-7070 OSVDB:27543  View
223283 23174 CVE-2006-7070 URL:http://www.osvdb.org/27543  View
223284 23174 CVE-2006-7070 SECTRACK:1016593  View
223285 23174 CVE-2006-7070 URL:http://securitytracker.com/id?1016593  View
223286 23174 CVE-2006-7070 SECUNIA:21208  View
223287 23174 CVE-2006-7070 URL:http://secunia.com/advisories/21208  View
223288 23174 CVE-2006-7070 SREASON:2326  View
223289 23174 CVE-2006-7070 URL:http://securityreason.com/securityalert/2326  View
223290 23174 CVE-2006-7070 XF:etomite-rfiles-file-upload(27947)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
52589 JVNDB-2007-001281 GeoClassifieds Enterprise におけるクロスサイトスクリプティングの脆弱性 GeoClassifieds Enterprise には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2006-7072 23174 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001281.html  View