CVE-2013-1668
CosCMS < 1.822 - Authenticated OS Command Injection via Uploaded File Name
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-1668. PoCs published by High-Tech Bridge SA.
AI-analyzed exploit summary This exploit demonstrates an OS command injection vulnerability in CosCms 1.721 via the filename parameter in a file upload request. The PoC shows how arbitrary commands can be executed on the server by manipulating the filename field in a multipart/form-data POST request.
Description
The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.
Exploits (1)
This exploit demonstrates an OS command injection vulnerability in CosCms 1.721 via the filename parameter in a file upload request. The PoC shows how arbitrary commands can be executed on the server by manipulating the filename field in a multipart/form-data POST request.