header-logo
Suggest Exploit
vendor:
CH-CMS.ch
by:
Unknown
7.5
CVSS
HIGH
Arbitrary File Upload
434
CWE
Product Name: CH-CMS.ch
Affected Version From: CH-CMS.ch 2
Affected Version To: Unknown
Patch Exists: NO
Related CWE:
CPE: a:ch-cms:ch-cms:2
Metasploit:
Other Scripts:
Platforms Tested: Unknown
Unknown

Arbitrary File Upload Vulnerabilities in CH-CMS.ch

CH-CMS.ch is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Mitigation:

It is recommended to apply the latest patches and updates provided by the vendor. Additionally, input validation and file-type checking should be implemented to prevent arbitrary file uploads.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/39888/info

CH-CMS.ch is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

CH-CMS.ch 2 is vulnerable; other versions may also be affected. 

http://www.example.com/Final/login/ava_up1.php
http://www.example.com/Final/login/ava_up12.php

Navigation

Suggest Exploit

Services By CQR