Unrestricted file upload

2009-11-2913:08:00

PRIOn knowledge base

www.prio-n.com

7.8 High

AI Score

Confidence

Low

0.128 Low

EPSS

Percentile

95.5%

JSON

Unrestricted file upload vulnerability in banner-edit.php in OpenX adserver 2.8.1 and earlier allows remote authenticated users with banner / file upload permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an images directory.

CPENameOperatorVersion
openxle2.8.1
openxeq2.8
openxeq2.4
openxeq2.6.3
openxeq2.6.1

Name	Operator	Version
openx	le	2.8.1
openx	eq	2.8
openx	eq	2.4
openx	eq	2.6.3
openx	eq	2.6.1

References

osvdb.org/60499

secunia.com/advisories/37475

www.openx.org/docs/2.8/release-notes/openx-2.8.2

www.securityfocus.com/archive/1/508050/100/0/threaded

www.securityfocus.com/bid/37110

developer.openx.org/jira/browse/OX-5747

exchange.xforce.ibmcloud.com/vulnerabilities/54394