ATutor < 2.2.4 - 'file_manager' Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "ATutor %q This module allows the user to run commands on the server with teacher user privilege. The 'Upload files' section in the 'File Manager'...

CVE-2018-20778

CVE-2018-20778 corresponds to Frog CMS 0.9.5 where the vulnerability exists in the admin/?/plugin/file_manager component. The issue arises from creating a new file containing a crafted attribute of an IMG element, enabling cross-site scripting (XSS). The affected software is Frog CMS 0.9.5; root ...

CVE-2018-20775

admin/?/plugin/filemanager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI...

CVE-2018-16373

Frog CMS 0.9.5 is affected by a file-upload vulnerability described as an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save. The available sources (NVD/NVD-derived entries and CNVD/PRION/CVE records) consistently identify Frog CMS 0.9.5 and the file_manager/save end...

CVE-2018-9992

Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/filemanager/browse/ screen...

CVE-2015-4463

The filemanager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL...

Design/Logic Flaw

The filemanager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL...

CVE-2015-4462

The CVE-2015-4462 issue affects eFront CMS pre-3.6.15.5 in the file_manager component. It enables absolute path traversal via the Upload file from url field in professor.php, allowing remote authenticated users to read arbitrary files on the server. No remediation details are provided in the conn...

CVE-2015-4463

The CVE-2015-4463 entry concerns the file_manager component of eFront CMS prior to version 3.6.15.5. Affected software: eFront CMS. What is vulnerable: the file_manager’s file upload handling can be bypassed by remote authenticated users through a crafted parameter appended to the file URL, enabl...

redaxscript 2.5.0 Code Execution

Security Advisory - Curesec Research Team 1. Introduction Affected Product: redaxscript 2.5.0 Fixed in: module has been removed in version 2.6.0 Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 10/02/2015...

redaxscript 2.5.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications redaxscript 2.5.0 - Multiple Vulnerabilities Description The module filemanager allows for file uploads, and uses exifimagetype to check the validity of the file. By setting the first bytes of the uploaded file to that of a valid image type, a...

TomatoCart - json.php Security Bypass

TomatoCart - json.php Security Bypass source: https://www.securityfocus.com/bid/57156/info TomatoCart is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and create files with arbitrary shell script which may aid in further...

MAXcms 3.11.20b - Remote File Inclusion / File Disclosure

MAXcms 3.11.20b RFI / File Disclosure Vulnerabilities I- Remote File Disclosure Vulnerabilities In /includes/inc.thcmsadmindirtree.php Code 22: if $GET"getjs"=="1" POC : http://localhost//microcms/includes/filemanager/special.php?fmincludesspecial=http://localhost/020.txt Thanx To ... | || \ \ \ ...