CVE-2015-7309
Bolt < 2.2.5 - Authenticated Remote Code Execution via Theme Editor File Rename
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2015-7309.
PoCs published by Metasploit, Tim Coen, including Metasploit module exploits/multi/http/bolt_file_upload.
AI-analyzed exploit summary This Metasploit module exploits an authenticated file upload vulnerability in Bolt CMS 2.2.4, allowing arbitrary PHP code execution by uploading a malicious file disguised as an image and renaming it to a .php extension.
Description
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Exploits (2)
This Metasploit module exploits an authenticated file upload vulnerability in Bolt CMS 2.2.4, allowing arbitrary PHP code execution by uploading a malicious file disguised as an image and renaming it to a .php extension.
This Metasploit module exploits an authenticated file upload vulnerability in Bolt CMS 2.2.4, allowing arbitrary PHP code execution by uploading a malicious file disguised as an image and renaming it to a .php extension.