Vulners
Lucene search
Collabtive 2.0 Shell Upload Vulnerability
| Reporter | Title | Published | Views | Family All 16 |
|---|---|---|---|---|
 | Collabtive Code Issue Vulnerability | 9 Mar 202000:00 | – | cnvd |
 | CVE-2015-0258 | 17 Feb 202017:46 | – | cve |
 | CVE-2015-0258 | 17 Feb 202017:46 | – | cvelist |
 | [SECURITY] [DLA 2125-1] collabtive security update | 28 Feb 202022:26 | – | debian |
 | Debian DLA-2125-1 : collabtive security update | 2 Mar 202000:00 | – | nessus |
| Ubuntu 16.04 LTS : Collabtive vulnerability (USN-4590-1) | 19 Oct 202000:00 | – | nessus |
 | CVE-2015-0258 | 17 Feb 202018:15 | – | nvd |
 | Ubuntu: Security Advisory (USN-4590-1) | 21 Oct 202000:00 | – | openvas |
| Debian: Security Advisory (DLA-2125-1) | 29 Feb 202000:00 | – | openvas |
 | DLA-2125-1 collabtive - security update | 28 Feb 202000:00 | – | osv |
10
Vulnerability title: Arbitrary File Upload In Collabtive
CVE: CVE-2015-0258
Vendor: Collabtive
Product: Collabtive
Affected version: 2.0
Fixed version: 2.1
Reported by: Arturo Rodriguez
Details:
It was discovered that authenticated users were able to upload files with extensions: php3, php4, php5 or phtml to the web server.
The issue is on the avatar upload functionality. The application checks if the filetype is an image but this can be bypassed using a proxy and changing the type to "image/jpeg" on the file upload request. The application also checks if the extension of the file is php or pl but it doesn't check for .php3 .php4 .php5 or phtml. It is possible to upload a file with one of these extensions and get code execution by going to http://installpath/files/standard/avatar/image_name
Even though a random value is appended to the name of the image, it is possible to get the name by seeing the requests the application does when the avatar image is loaded.
Impact:
An attacker could exploit the functionality to upload server scripts which, when requested by a browser, would execute code on the server.
# 0day.today [2018-04-09] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
29 Sep 2015 00:00Current
0.3Low risk
Vulners AI Score0.3
EPSS0.12936