medium4.9Public exploit code
CVE-2007-6479
Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile" page) in Dokeos 1.8.4 allows remote au…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Dokeos 1.8.4 - Arbitrary File Upload2007-12-18 · webapps · php · Verified
Impact
Unrestricted file upload vulnerability in the "My productions" component for main/auth/profile.php (aka the "My profile" page) in Dokeos 1.8.4 allows remote authenticated users to upload and execute arbitrary PHP files via a filename with a double extension, which can then be accessed through a URI under main/upload/users/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dokeos | Dokeos | Version 1.8.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/28154
- http://www.securityfocus.com/bid/26940
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39148
- https://www.exploit-db.com/exploits/4753
- http://secunia.com/advisories/28154
- http://www.securityfocus.com/bid/26940
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39148
- https://www.exploit-db.com/exploits/4753