|
Description
|
|
Sammy Forgit has discovered a vulnerability in the Hupsis Media Gallery plugin for e107, which can be exploited by malicious people to compromise a vulnerable system.
The vulnerability is caused due to the e107_plugins/hupsis_media_gallery/FileManager/ajaxfilemanager/ajax_file_upload.php script improperly validating uploaded files, which can be exploited to execute arbitrary PHP code by uploading a PHP file with e.g. an appended ".gif" file extension.
Successful exploitation requires that Apache is not configured to handle the mime-type for media files with e.g. a ".gif" extension (Configured to handle by default).
The vulnerability is confirmed in version 1.0. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
Hupsis Media Gallery 1.x (plugin for e107)
|
|
|
|
|
|
Solution
|
|
Restrict access to the e107_plugins/hupsis_media_gallery/FileManager/ajaxfilemanager/ajax_file_upload.php script (e.g. via .htaccess).
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
OpenSysCom:
http://www.opensyscom.fr/Actualites/e107-plugins-hupsis-media-gallery-arbitrary-file-upload-vulnerability.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
