medium6.5Public exploit code
CVE-2013-4898
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to ex…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload2013-08-02 · webapps · php
Impact
Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in public/temporary/timeline/.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webhive | Timeline | Version 4.2.5 |