Описание
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2015-7309
- https://bolt.cm/newsitem/bolt-2-2-5-released
- https://www.exploit-db.com/exploits/38196
- http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html
- http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.html
- http://seclists.org/fulldisclosure/2015/Aug/66
- http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_upload
Связанные уязвимости
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
The theme editor in Bolt allows remote authenticated users to execute arbitrary code by renaming a crafted file