CVE-2008-2686

webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.

Link	Resource
http://www.securityfocus.com/bid/29618	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/42961
https://www.exploit-db.com/exploits/5767

Configuration 1

cpe:2.3:a:flux_cms:flux_cms:1.4:*:*:*:*:*:*:* cpe:2.3:a:flux_cms:flux_cms:1.31:*:*:*:*:*:*:* cpe:2.3:a:flux_cms:flux_cms:*:*:*:*:*:*:*:* cpe:2.3:a:flux_cms:flux_cms:1.2:*:*:*:*:*:*:* cpe:2.3:a:flux_cms:flux_cms:1.3:*:*:*:*:*:*:*

---

Published : 2008-06-13 06:41

Updated : 2017-09-29 01:31

---

NVD link : CVE-2008-2686

Mitre link : CVE-2008-2686

No products.

CWE-20