VulnerabilityModified
CVE-2008-2574
Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in tus_imagenes/.
HIGH 7.5EPSS 4.78%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.78%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to execute arbitrary code by uploading a .php file, then accessing it via a direct request to the file in tus_imagenes/.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 4.78% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- flashblog/flashblog
- Source
- cve@mitre.org
References
- http://securityreason.com/securityalert/3928
- http://www.dumenci.net/web-action/flashblog-beta0.31-remote-file-upload-vulnerability.htmlExploit
- http://www.flashblog.org
- http://www.securityfocus.com/archive/1/492738/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42820
- https://www.exploit-db.com/exploits/5728
- http://securityreason.com/securityalert/3928
- http://www.dumenci.net/web-action/flashblog-beta0.31-remote-file-upload-vulnerability.htmlExploit
- http://www.flashblog.org
- http://www.securityfocus.com/archive/1/492738/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42820
- https://www.exploit-db.com/exploits/5728
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.