vendor:
Article Manager Pro
by:
ZoRLu
7,5
CVSS
HIGH
Remote Shell Upload
434
CWE
Product Name: Article Manager Pro
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
AlstraSoft Article Manager Pro Remote Shell Upload Vulnerability
A vulnerability exists in AlstraSoft Article Manager Pro which allows an attacker to upload a malicious shell to the vulnerable server. The attacker can then use the shell to execute arbitrary commands on the server. The vulnerability is due to insufficient validation of the uploaded file type, allowing an attacker to upload a malicious shell with a double extension such as .php.jpg. The malicious shell can then be accessed by the attacker via the URL http://www.example.com/article/images/author_pics/[id].php.
Mitigation:
The vendor has released a patch to address this vulnerability. Users should upgrade to the latest version of AlstraSoft Article Manager Pro.
