7.5

CVE-2009-4090

Exploit
Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute arbitrary code by uploading a file with a name containing a NULL byte.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Telepark ≫ Telepark.Wiki Version <= 2.4.23
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.21% 0.865
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://blog.telepark.com/telepark-web-software/2009/11/09/telepark-wiki-security-fixes/
Patch
http://packetstormsecurity.org/0911-exploits/Telepark-fixes-nov09-2.txt
Exploit
http://secunia.com/advisories/37391
Vendor Advisory
Exploit
http://www.osvdb.org/60219
https://exchange.xforce.ibmcloud.com/vulnerabilities/54294