vendor:
Flax Article Manager
by:
S.W.A.T.
7.5
CVSS
HIGH
Remote File Upload Vulnerability
434
CWE
Product Name: Flax Article Manager
Affected Version From: 1.1
Affected Version To: 1.1
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2009
Flax Article Manager 1.1 Remote File Upload Vulnerability
A vulnerability in Flax Article Manager 1.1 allows an attacker to upload a malicious file to the server. An attacker can register on the site, choose a malicious file as their avatar, and the malicious file will be uploaded to the server. The malicious file can then be accessed by going to the profile page of the attacker and right-clicking on the avatar to view the properties. The malicious file can then be accessed by going to the URL of the malicious file.
Mitigation:
To mitigate this vulnerability, the application should validate the file type of the uploaded file and only allow certain file types to be uploaded.
