high7.5Public exploit code
CVE-2008-2686
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Flux CMS 1.5.0 - 'loadsave.php' Arbitrary File Overwrite2008-06-09 · webapps · php · Verified
Impact
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flux Cms | Flux Cms | through 1.50 Versions 1.2, 1.3, 1.4, 1.31 |