NVD

Id
57239  
Name
CVE-2007-5156  
Description
Incomplete blacklist vulnerability in editor/filemanager/upload/php/upload.php in FCKeditor, as used in SiteX CMS 0.7.3.beta, La-Nai CMS, Syntax CMS, Cardinal Cms, and probably other products, allows remote attackers to upload and execute arbitrary PHP code via a file whose name contains ".php." and has an unknown extension, which is recognized as a .php file by the Apache HTTP server, a different vulnerability than CVE-2006-0658 and CVE-2006-2529.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-10-01  
Modified Date
2011-10-12  
Seq
2007-5156  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
292275 57239 CVE-2007-5156 http://dev.fckeditor.net/changeset/973  View
292276 57239 CVE-2007-5156 http://dev.fckeditor.net/ticket/1325  View
292277 57239 CVE-2007-5156 http://downloads.securityfocus.com/vulnerabilities/exploits/30677.php  View
292278 57239 CVE-2007-5156 3182  View
292279 57239 CVE-2007-5156 http://sourceforge.net/forum/forum.php?forum_id=743930  View
292280 57239 CVE-2007-5156 http://sourceforge.net/project/shownotes.php?release_id=546000  View
292281 57239 CVE-2007-5156 5618  View
292282 57239 CVE-2007-5156 5688  View
292283 57239 CVE-2007-5156 20070927 [waraxe-2007-SA#057] - Unauthorized File Upload in SiteX CMS  View
292284 57239 CVE-2007-5156 29422  View
292285 57239 CVE-2007-5156 30677  View
292286 57239 CVE-2007-5156 ADV-2007-3464  View
292287 57239 CVE-2007-5156 ADV-2007-3465  View
292288 57239 CVE-2007-5156 http://www.waraxe.us/advisory-57.html  View
292289 57239 CVE-2007-5156 lanai-upload-file-upload(42425)  View
292290 57239 CVE-2007-5156 syntaxcms-upload-file-upload(42733)  View
292291 57239 CVE-2007-5156 cardinal-upload-file-upload(44455)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
54018 JVNDB-2007-002710 SiteX CMS などで使用される FCKeditor の editor/filemanager/upload/php/upload.php における任意の PHP コードを実行される脆弱性 SiteX CMS、La-Nai CMS、Syntax CMS、Cardinal Cms などで使用される FCKeditor の editor/filemanager/upload/php/upload.php は、不完全なブラックリストが発生するため、任意の PHP コードを実行される脆弱性が存在します。 CVE-2007-5156 28511 CVE-2007-5156 57239 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002710.html 2007-10-01 2012-06-26 View