vendor:
TinyMCE
by:
Vladimir Vorontsov
8,8
CVSS
HIGH
File Upload Vulnerability
434
CWE
Product Name: TinyMCE
Affected Version From: 3.2.3
Affected Version To: 3.2.3
Patch Exists: YES
Related CWE: N/A
CPE: tinymce/plugins_filemanager
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
File Upload Vulnerability [ Plugins tiny_mce ]
A file upload vulnerability exists in the TinyMCE plugin, which allows an attacker to upload malicious files to the server. The vulnerability is due to the lack of proper input validation and sanitization of the uploaded files. An attacker can exploit this vulnerability by uploading a malicious file with a .gif extension, which can then be moved to a .php extension.
Mitigation:
Input validation and sanitization should be implemented to prevent malicious files from being uploaded.
