vendor:
eVision CMS
by:
Osirys
7.5
CVSS
HIGH
Remote Command Execution
94
CWE
Product Name: eVision CMS
Affected Version From: 2
Affected Version To: 2
Patch Exists: NO
Related CWE: N/A
CPE: a:e-vision:e-vision:2.0
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Linux
2008
eVision CMS 2.0 Remote Command Execution Exploit
eVision CMS 2.0 is vulnerable to arbitrary file upload. When the user uploads a file, on it will be added the .gif extension. But this cms is vulnerable to Local File Inclusion, so we can include the .gif file and execute it.
Mitigation:
Ensure that the application is not vulnerable to Local File Inclusion.
