CVE-2008-2267
CMS Made Simple <= 1.2.4 - Remote Code Execution via File Upload Bypass
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-2267. PoCs published by EgiX.
AI-analyzed exploit summary This exploit targets a file upload vulnerability in CMS Made Simple <= 1.2.4, allowing arbitrary file uploads due to insufficient extension filtering. It uploads a malicious PHP shell and provides interactive command execution.
Description
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/.
Exploits (1)
This exploit targets a file upload vulnerability in CMS Made Simple <= 1.2.4, allowing arbitrary file uploads due to insufficient extension filtering. It uploads a malicious PHP shell and provides interactive command execution.