CVE-2008-2686

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 86%
VendorProductVersion
flux_cmsflux_cms
𝑥
≤ 1.50
flux_cmsflux_cms
1.2
flux_cmsflux_cms
1.3
flux_cmsflux_cms
1.4
flux_cmsflux_cms
1.31
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/29618
https://exchange.xforce.ibmcloud.com/vulnerabilities/42961
https://www.exploit-db.com/exploits/5767
http://www.securityfocus.com/bid/29618
https://exchange.xforce.ibmcloud.com/vulnerabilities/42961
https://www.exploit-db.com/exploits/5767