CVE-2008-2267
Last modified
CVE-2008-2267 is a vulnerability of currently unknown severity. Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.. EPSS estimates a 4.81% chance of exploitation in the next 30 days.
Description
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cms Made Simple | Cms Made Simple | 1.2.4 |
References
- http://secunia.com/advisories/30208Vendor Advisory
- http://secunia.com/advisories/30208Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-2267?
How severe is CVE-2008-2267?
How do I fix CVE-2008-2267?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2008
- CVE-2008-2261Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2008-2262Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2008-2263SQL injection vulnerability in linking.page.php in Automated…
- CVE-2008-2264Cross-site scripting (XSS) vulnerability in index.php in Cyr…
- CVE-2008-2265SQL injection vulnerability in news.php in EMO Realty Manage…
- CVE-2008-2266uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before…
- CVE-2008-2268Open redirect vulnerability in interface/redirect.htm.php in…
- CVE-2008-2269AustinSmoke GasTracker (AS-GasTracker) 1.0.0 allows remote a…
- CVE-2008-2270Multiple PHP remote file inclusion vulnerabilities in PHPWAY…
- CVE-2008-2271The Site Documentation Drupal module 5.x before 5.x-1.8 and …
- CVE-2008-2272Multiple cross-site scripting (XSS) vulnerabilities in the w…
- CVE-2008-2273Unspecified vulnerability in the TACACS authentication compo…
Are you affected by CVE-2008-2267?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST