CVE-2008-7026
21.08.2009, 14:30
Unrestricted file upload vulnerability in filesystem3.class.php in eFront 3.5.1 build 2710 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension as an avatar, then accessing it via a direct request to the file in (1) student/avatars/ or (2) professor/avatars/.Enginsight
| Vendor | Product | Version |
|---|---|---|
| efrontlearning | efront | 𝑥 ≤ 3.5.1 |
| efrontlearning | efront | 3.1.0 |
| efrontlearning | efront | 3.1.2 |
| efrontlearning | efront | 3.1.3 |
| efrontlearning | efront | 3.1.4 |
| efrontlearning | efront | 3.5.0 |
| efrontlearning | efront | 3.5.0:beta1 |
| efrontlearning | efront | 3.5.0:beta2 |
| efrontlearning | efront | 3.5.0:beta3 |
| efrontlearning | efront | 3.5.0:beta4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References